Local Path Manipulation Vulnerability in Spring Boot's Artemis Message Broker

CVE-2026-41001

What is CVE-2026-41001?

A local path manipulation vulnerability exists in Spring Boot’s ArtemisEmbeddedConfigurationFactory due to a static and fixed path for the embedded Artemis message broker's data directory. When no specific path is configured, this predictable directory can be exploited by a local attacker on the same host. By pre-creating the directory or placing a symlink prior to the application startup, an attacker could potentially manipulate the application’s behavior or gain unauthorized access to data. It is crucial for users of affected versions to review their configurations and implement secure practices to mitigate this risk.

References