Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured.

A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. This enables the attacker to hijack message queue data, inject malicious messages, or potentially execute code via deserialization attacks through the journal.