{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ce39fb0e-88b7-5d76-abf0-c6e08a400679",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-file",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-file@6.5.9-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-file@6.5.9-tuxcare.2",
      "version": "6.5.9-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-file",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-file@6.5.9",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.5.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40987",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-file@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:49723cf1-4b97-52bf-ae48-ea44896713b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40987 does not affect version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-file. Spring Integration 6.5.9 contains the upstream fix for CVE-2026-40987 (path traversal in FTP/SFTP/SMB file downloads). The defense method FileUtils.newFileInDirectoryIfValid() validates all file paths before creation, rejecting absolute paths and directory traversal sequences. This fix was present in the upstream Spring Integration 6.5.9 release (authored by Glenn Renfro from Broadcom on June 1.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-file@6.5.9-tuxcare.2"
    }
  ]
}