Vulnerability Directory | CVE-2026-41001

Overview

Spring Boot is a framework that simplifies building production-ready, stand-alone Java applications on top of the Spring ecosystem, providing auto-configuration, embedded servers, and opinionated defaults. Its JMS auto-configuration can start an embedded Apache Artemis message broker when one is on the classpath.

A medium-severity vulnerability (CVE-2026-41001) has been identified in Spring Boot's embedded Artemis auto-configuration. When no explicit data directory is configured, ArtemisEmbeddedConfigurationFactory derives the broker's data directory from the shared system temporary directory plus the fixed subdirectory name artemis-data, producing a fully predictable path. A local attacker on the same host can pre-create this directory, or plant a symlink in its place, before the application starts. The embedded broker then reads and writes its journal, bindings, and paging data through an attacker-influenced location, which can be used to hijack or tamper with message-queue data, inject messages, or reach deserialization code paths through crafted journal contents.

Per OWASP, an insecure temporary file occurs when an application creates temporary resources at predictable locations that other local users can observe or pre-create, allowing them to read, modify, or hijack the data the application stores there.

This issue affects versions >=0.0.0 <2.7.34, >=3.3.0 <3.3.20, >=3.4.0 <3.4.17, >=3.5.0 <3.5.15, and >=4.0.0 <4.0.7 of Spring Boot.

‍

Details

Module Info

Product: Spring Boot
Affected packages: spring-boot-autoconfigure
Affected versions: >=0.0.0 <2.7.34, >=3.3.0 <3.3.20, >=3.4.0 <3.4.17, >=3.5.0 <3.5.15, >=4.0.0 <4.0.7
GitHub repository: https://github.com/spring-projects/spring-boot
Published packages: https://central.sonatype.com/artifact/org.springframework.boot/spring-boot-autoconfigure
Package manager: maven
Fixed in:
NES for Spring Boot
Spring Boot 4.0.7, 3.5.15 (OSS)

Vulnerability Info

The embedded Artemis broker is configured by ArtemisEmbeddedConfigurationFactory. When the application does not set an explicit data directory, the factory computes one from the JVM system temporary directory and a constant subdirectory name:

private String getDataDir() {
    if (this.properties.getDataDirectory() != null) {
        return this.properties.getDataDirectory();
    }
    String tempDirectory = System.getProperty("java.io.tmpdir");
    return new File(tempDirectory, "artemis-data").getAbsolutePath();
}

Because both the system temporary directory and the artemis-data subdirectory name are predictable and shared across local users, the resulting path can be anticipated by any user on the host. An attacker can create artemis-data ahead of the application, set permissions or ownership in their favor, or replace it with a symlink pointing at a sensitive location. When the broker starts, it stores its journal and bindings under that attacker-controlled directory. Artemis journal records can carry serialized message bodies, so control over this directory enables message tampering, message injection, and deserialization-based attack avenues, in addition to disclosure of queued data.

The remediation routes the default through Spring Boot's ApplicationTemp, which returns an application-specific subdirectory whose name is not predictable to other local users and which is created with restrictive ownership, so the broker's data directory can no longer be pre-created or hijacked by an unprivileged local user.

‍

Mitigation

All affected Spring Boot lines covered by HeroDevs Never-Ending Support are past their open-source end-of-life and several of the affected lines have no publicly available fix; the upstream advisory ships public (OSS) releases only for the still-maintained 4.0.x and 3.5.x lines, while the 3.4.x, 3.3.x, and 2.7.x fixes were not released as public OSS versions.

Recommended actions:

Upgrade to a supported Spring Boot version that contains the fix (Spring Boot 4.0.7 or 3.5.15) where feasible.
For applications that must remain on an end-of-life Spring Boot line, use HeroDevs Never-Ending Support (NES) for Spring Boot, which provides a backported fix for this vulnerability on otherwise unsupported lines.

As an interim configuration-level hardening, set an explicit, securely-permissioned data directory for the embedded broker (the spring.artemis.embedded.data-directory property) so the predictable default path is not used.

‍