On: Major flaw in Java-based Spring Framework allows remote-code execution

In the service of "teach him to walk prior to attempting to teaching him to run", maybe you could start with a discussion of software security, and then show him an example of how bad guys can use good code that looks trivial to do things you don't want them to do. You can come up with numerous vulnerabilities in application code using any reduced subset of Java which he understands. Without that background, he'd have to learn an awful lot of Deep Magick about J2EE to understand what is happening here.

For a simple example, write a bare bones web server where localhost/dir/file.html serves documentroot/dir/file.html.

Extend it with directory browsing, if you want.

Then, show them the joy of localhost/../../secret/mydiary.txt