Spring Boot's ArtemisEmbeddedConfigurationFactory component uses a predictable, fixed static path for the embedded Artemis message broker's data directory when no explicit configuration is provided. This insecure temporary file handling (CWE-377) can be exploited by a local attacker with access to the host to pre-create the directory or create symbolic links before the application starts, potentially causing unintended file access or modification. The affected versions include Spring Boot 2.7.0 through 2.7.33, 3.3.0 through 3.3.19, 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. The CVSS 3.1 base score is 5.3 (medium), reflecting local attack vector with low complexity and no user interaction required, impacting confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch is currently available.

A local attacker on the same host can exploit the predictable static path to pre-create or symlink the Artemis message broker's data directory, potentially leading to unauthorized access or modification of data used by the embedded broker. This can result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS score. The attack requires local access and low complexity but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running Spring Boot applications with embedded Artemis broker on shared or untrusted hosts, or explicitly configure the data directory path to a secure, non-predictable location to mitigate the risk of directory pre-creation or symlink attacks.