← Back

CVE-2026-41001

nvd nist
Published: Jun 11, 2026Modified: Sep 4, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Exploitability: 1.8 / Impact: 3.4
Source: security@vmware.com (Secondary)

Description

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.

Affected (5)

Products: Vmware: Spring Boot
Vmware
1 product
Spring Boot
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Boot
Before 2.7.34
Spring Boot
From 3.3.0 to 3.3.20
Spring Boot
From 3.4.0 to 3.4.17
Spring Boot
From 3.5.0 to 3.5.14.1
Spring Boot
From 4.0.0 to 4.0.6.1

Related CWEs

CWE-377
Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.