Executive brief
Spring Boot is a popular framework used to build and run Java-based web applications. A security flaw allows a local attacker with access to the same server to take control of the application's temporary directory. This could lead to the theft of user session data, account hijacking, or the ability to execute malicious code as the application user.
Technical details
An insecure temporary file vulnerability (CWE-377) exists in Spring Boot's ApplicationTemp component due to predictable directory naming and insufficient ownership verification. A local attacker with low privileges can pre-create or take control of this directory. If the application is configured with persistent sessions (server.servlet.session.persistent=true), the attacker can read session data across restarts or deploy a gadget chain to achieve arbitrary code execution in the context of the application user. The vulnerability is mitigated by upgrading to versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33.
Affected products
- VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32
Timeline
- 2026-04-27: advisory: Initial advisory published by VMware
- 2026-04-28: disclosed: NVD publication date