Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn morePredictable temp directory accepted without ownership verification
Description
A local attacker on the same host as the application may be able to take control of the
directory used by ApplicationTemp. When server.servlet.session.persistent is set to
true and the attack persists across application restarts, this may allow the attacker
to read session information and hijack authenticated users or deploy a gadget chain and
execute code as the application's user.
Affected Spring Products and Versions
Spring Boot:
- 4.0.0 - 4.0.5
- 3.5.0 - 3.5.13
- 3.4.0 - 3.4.15
- 3.3.0 - 3.3.18
- 2.7.32 and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 4.0.6 | OSS |
| 3.5.14 | OSS |
| 3.4.16 | Enterprise Support Only |
| 3.3.19 | Enterprise Support Only |
| 2.7.33 | Enterprise Support Only |
No further mitigation steps are necessary.
History
- 2026-04-23: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all