CVE-2026-59311: CWE-59 Improper Link Resolution Before File Access ('Link Following') in Spring Spring Integration

CVE-2026-59311 is an instance of CWE-59 (Improper Link Resolution Before File Access) in Spring Integration. It allows a local unprivileged user on the same host to manipulate the output directory of Zip/UnZip transformers by creating a symbolic link at /tmp/ziptransformer prior to application startup. This symlink redirection can cause the application to write output files to an unintended directory, potentially leading to integrity and availability impacts. The affected versions explicitly include Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows a local unprivileged user to redirect the output of Zip/UnZip transformers to arbitrary directories by exploiting symbolic link resolution. This can lead to integrity and availability impacts, such as overwriting or placing files in unintended locations. Confidentiality impact is not indicated. The CVSS vector indicates network attack vector is not applicable (local), high attack complexity, low privileges required, no user interaction, and unchanged scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the application with untrusted local users who can create symbolic links in /tmp or other relevant directories before application startup. Consider monitoring and restricting the creation of symbolic links in temporary directories used by the application.