216.73.217.22

CVE-2026-40973

· Published 28/04/2026 00:16 · Modified 28/04/2026 20:11

Labels: CVE-2026-40973 2026-04-28CVE-2026-40973CWE-377[email protected]

Essential information

Published
28/04/2026 00:16
Modified
28/04/2026 20:11
Author
Creator
CVSS
7.0 HIGH (v3.1)
CISA KEV
No
CWE
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.

NVD status

Status
Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
spring / spring boot cpe:2.3:a:spring:spring_boot:4.0.0-4.0.5:*:*:*:*:*:*:*
spring / spring boot cpe:2.3:a:spring:spring_boot:3.5.0-3.5.13:*:*:*:*:*:*:*
spring / spring boot cpe:2.3:a:spring:spring_boot:3.4.0-3.4.15:*:*:*:*:*:*:*
spring / spring boot cpe:2.3:a:spring:spring_boot:3.3.0-3.3.18:*:*:*:*:*:*:*
spring / spring boot cpe:2.3:a:spring:spring_boot:2.7.0-2.7.32:*:*:*:*:*:*:*

References