PT-2026-35545 · Vmware · Spring Boot

Published 2026-04-27 · Updated 2026-06-03 · CVE-2026-40973

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Spring Boot versions 3.4.0 through 3.4.15 Spring Boot versions 3.3.0 through 3.3.18 Spring Boot versions 2.7.0 through 2.7.32 Spring Boot versions prior to 2.7.0

Description A local attacker on the same host as the application can take control of the directory used by ApplicationTemp due to predictable temporary directory paths and lack of ownership verification. If the variable server.servlet.session.persistent is set to true and the attack persists across application restarts, the attacker may read session information to hijack authenticated users or deploy a gadget chain to execute code as the application user.

Recommendations Update to version 4.0.6 Update to version 3.5.14 Update to version 3.4.16 Update to version 3.3.19 Update to version 2.7.33

Fix

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2026-40973

GHSA-WWPQ-F5C3-7HVX

Affected Products

Spring Boot

References · 11

• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-40973 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wwpq-f5c3-7hvx · Vendor Advisory
• https://spring.io/security/cve-2026-40973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40973 · Security Note
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/infoflowcloud/status/2049350925190381797 · Twitter Post
• https://twitter.com/CVEnew/status/2049350462747652198 · Twitter Post
• https://twitter.com/threatcluster/status/2048862413106114575 · Twitter Post
• https://t.me/CVEtracker/51999 · Telegram Post
• https://twitter.com/CVEarity/status/2049013409002492391 · Twitter Post
• https://twitter.com/CCBalert/status/2049164243509862496 · Twitter Post