RCE now working if vuln spring is on the server classpath