Web applications created in the Spring platform could leave users open to remote code execution, CISA and others are warning.