Spring Boot's ArtemisEmbeddedConfigurationFactory component uses a predictable, static filesystem path for the embedded Artemis message broker's data directory when no custom path is set by the user. This behavior enables a local attacker with access to the host to create the directory or a symbolic link at that location before the application starts, which can lead to insecure temporary file usage (CWE-377). The vulnerability affects multiple Spring Boot versions including 2.7.0 through 2.7.33, 3.3.0 through 3.3.19, 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. The CVSS 3.1 base score is 5.3, indicating medium severity, with attack vector local, low complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

A local attacker on the same host can exploit this vulnerability to pre-create or symlink the fixed data directory used by the embedded Artemis broker, potentially leading to unauthorized access to data, modification of data, or disruption of service. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the application with default embedded Artemis configurations on multi-user systems or restrict local access to trusted users only. Explicitly configuring a non-predictable data directory path for the embedded Artemis broker may mitigate the risk.