CVE-2026-40977

Published: Apr 28, 2026Modified: Jul 24, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.

Affected (5)

Products: Vmware: Spring Boot

Vmware

1 product

Spring Boot

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Boot	Before 2.7.33
Vmware Spring Boot	From 3.3.0 to 3.3.19
Vmware Spring Boot	From 3.4.0 to 3.4.16
Vmware Spring Boot	From 3.5.0 to 3.5.14
Vmware Spring Boot	From 4.0.0 to 4.0.6

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

https://spring.io/security/cve-2026-40977

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.