Get Web App root from Spring Controller

To get reference to ServletContext, your class can implement ServletContextAware

ServletContext is also accessible in the web application container under the bean name servletContext, so you can inject it like any other bean in Spring. This works even if you don't have a session, and dependency injection is the Spring way.

I thought getting a ServletContext() then using realPath() may work, but I don't have a reference to ServletContext

Yes you do. See HttpServletRequest.getSession().getServletContext()