← Back

CVE-2026-59311

nvd nist
Published: Aug 27, 2026Modified: Aug 31, 2026

JSON object

Loading...
6.8
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Exploitability: 1.6 / Impact: 5.2
Source: security@vmware.com (Secondary)

Description

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Affected (8)

Vmware
1 product
Spring Integration
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Integration
6.4.0 ≤ version ≤ 6.4.12
Spring Integration
6.5.0 ≤ version ≤ 6.5.10
Spring Integration
7.0.0 ≤ version ≤ 7.0.5
Spring Integration
Version 7.1.0
Spring Integration
Version 7.1.0 milestone1
Spring Integration
Version 7.1.0 milestone2
Spring Integration
Version 7.1.0 milestone3
Spring Integration
Version 7.1.0 rc1

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.