AIKIDO-2026-386653
spring-boot-autoconfigure is vulnerable to Insecure Temporary File
53
Medium Risk
This Affects:
spring-boot-autoconfigureTL;DR
Spring Boot's Artemis auto-configuration uses a predictable, static directory for embedded Artemis broker data when no custom data directory is configured. A local attacker with access to the same host can pre-create the directory or replace it with a symbolic link before application startup, potentially enabling unauthorized access to message queue data, message tampering, or further exploitation through malicious journal contents.
Who does this affect?
You are affected if using a vulnerable version.
Background info
spring-boot-autoconfigure is vulnerable to Insecure Temporary File in versions 0.0.1 - 3.5.14 and 4.0.0 - 4.0.6.
How to fix this
Upgrade the org.springframework.boot:spring-boot-autoconfigure library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.