Description

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured.

A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. This enables the attacker to hijack message queue data, inject malicious messages, or potentially execute code via deserialization attacks through the journal.

Affected Spring Products and Versions

Spring Boot:

• 4.0.0 - 4.0.6
• 3.5.0 - 3.5.14
• 3.4.0 - 3.4.16
• 3.3.0 - 3.3.19
• 2.7.0 - 2.7.33

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Credit

This issue was identified and responsibly reported by Yu Bao[https://github.com/August829] - [email protected], who works for paypal.com.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L&version=3.1

History

• 2026-06-03: Initial vulnerability report published.