Executive brief
Spring Boot is a popular framework used by developers to build and run Java applications. A vulnerability in how the software handles process ID (PID) files could allow a local user with specific file permissions to corrupt other files on the system. This occurs when the application starts up, potentially leading to system instability or data loss if critical system files are targeted.
Technical details
A 'Link Following' vulnerability (CWE-59) exists in Spring Boot's ApplicationPidFileWriter component. When an application is configured to write a PID file, a local attacker who already possesses write access to the directory where the PID file is stored can create a symbolic link. Because the application does not properly validate the link before writing, it will follow the symlink and overwrite the target file with the application's process ID. This attack requires local access and high privileges (PR:H) or specific directory permissions. The issue is resolved in Spring Boot versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33.
Affected products
- VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32
Timeline
- 2026-04-28: advisory: Vendor advisory published by VMware/Spring
- 2026-04-28: disclosed: NVD publication date