GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-40973 (GCVE-0-2026-40973)

Vulnerability from cvelistv5 – Published: 2026-04-27 23:29 – Updated: 2026-04-29 03:55
VLAI
Summary
A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-28 00:00 UTC
CWE
  • CWE-377 - Insecure Temporary File
Assigner
References
Impacted products
Vendor Product Version CPE status
Spring Spring Boot Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.14 (custom)
Affected: 3.4.0 , < 3.4.16 (custom)
Affected: 3.3.0 , < 3.3.19 (custom)
Affected: 2.7.0 , < 2.7.33 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T03:55:43.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Boot",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.14",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.16",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.19",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.33",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA local attacker on the same host as the application may be able to take control of the directory used by \u003ccode\u003eApplicationTemp\u003c/code\u003e. When \u003ccode\u003eserver.servlet.session.persistent\u003c/code\u003e is set to \u003ccode\u003etrue\u003c/code\u003e and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); predictable temp directory / \u003ccode\u003eApplicationTemp\u003c/code\u003e ownership verification. Versions that are no longer supported are also affected per vendor advisory.\u003c/p\u003e"
            }
          ],
          "value": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Per CVSS v3.1: Confidentiality HIGH; Integrity HIGH; Availability HIGH."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377: Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T23:29:51.946Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40973"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40973",
    "datePublished": "2026-04-27T23:29:51.946Z",
    "dateReserved": "2026-04-16T02:18:56.133Z",
    "dateUpdated": "2026-04-29T03:55:43.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40973",
      "date": "2026-09-16",
      "epss": "0.00136",
      "percentile": "0.0339"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40973\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-04-28T00:16:24.357\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\\n\\nAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.\"},{\"lang\":\"es\",\"value\":\"Un atacante local en el mismo host que la aplicaci\u00f3n podr\u00eda tomar el control del directorio utilizado por \u0027ApplicationTemp\u0027. Cuando \u0027server.servlet.session.persistent\u0027 se establece en \u0027true\u0027 y el ataque persiste a trav\u00e9s de los reinicios de la aplicaci\u00f3n, esto podr\u00eda permitir al atacante leer informaci\u00f3n de la sesi\u00f3n y secuestrar usuarios autenticados o desplegar una cadena de gadgets y ejecutar c\u00f3digo como el usuario de la aplicaci\u00f3n.\\n\\nAfectado: Spring Boot 4.0.0-4.0.5 (correcci\u00f3n 4.0.6), 3.5.0-3.5.13 (correcci\u00f3n 3.5.14), 3.4.0-3.4.15 (correcci\u00f3n 3.4.16), 3.3.0-3.3.18 (correcci\u00f3n 3.3.19), 2.7.0-2.7.32 (correcci\u00f3n 2.7.33); verificaci\u00f3n de propiedad de directorio temporal predecible / \u0027ApplicationTemp\u0027. Las versiones que ya no son compatibles tambi\u00e9n se ven afectadas seg\u00fan el aviso del proveedor.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring Boot\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.14\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.3.0\",\"lessThan\":\"3.3.19\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.7.0\",\"lessThan\":\"2.7.33\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-28T00:00:00+00:00\",\"id\":\"CVE-2026-40973\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-377\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.33\",\"matchCriteriaId\":\"5B1C9BD7-7555-4B3D-AED9-60C3C13DCF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.3.19\",\"matchCriteriaId\":\"28EE6470-24FD-49D1-A2F0-7A19B290A161\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.16\",\"matchCriteriaId\":\"758A9E8F-0C52-43D9-8D84-69622B345A4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.14\",\"matchCriteriaId\":\"D23096A1-8269-46C5-9215-9098E87D0A24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.6\",\"matchCriteriaId\":\"12A166C5-8B55-4BA3-AA8B-6024A257D441\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40973\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-13T12:25:53+00:00",
      "cve": "CVE-2026-40973",
      "id": "CVE-2026-40973",
      "initial_release_date": "2026-04-27T23:29:51.946000+00:00",
      "product_status:fixed": "10",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "68",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40973.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40973\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-28T12:42:23.335248Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-28T12:42:35.598Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Per CVSS v3.1: Confidentiality HIGH; Integrity HIGH; Availability HIGH.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring Boot\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.3.0\", \"lessThan\": \"3.3.19\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.7.0\", \"lessThan\": \"2.7.33\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40973\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\\n\\nAffected: Spring Boot 4.0.0\\u20134.0.5 (fix 4.0.6), 3.5.0\\u20133.5.13 (fix 3.5.14), 3.4.0\\u20133.4.15 (fix 3.4.16), 3.3.0\\u20133.3.18 (fix 3.3.19), 2.7.0\\u20132.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA local attacker on the same host as the application may be able to take control of the directory used by \u003ccode\u003eApplicationTemp\u003c/code\u003e. When \u003ccode\u003eserver.servlet.session.persistent\u003c/code\u003e is set to \u003ccode\u003etrue\u003c/code\u003e and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\\u20134.0.5 (fix 4.0.6), 3.5.0\\u20133.5.13 (fix 3.5.14), 3.4.0\\u20133.4.15 (fix 3.4.16), 3.3.0\\u20133.3.18 (fix 3.3.19), 2.7.0\\u20132.7.32 (fix 2.7.33); predictable temp directory / \u003ccode\u003eApplicationTemp\u003c/code\u003e ownership verification. Versions that are no longer supported are also affected per vendor advisory.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-377\", \"description\": \"CWE-377: Insecure Temporary File\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-04-27T23:29:51.946Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40973\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-29T03:55:43.148Z\", \"dateReserved\": \"2026-04-16T02:18:56.133Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-04-27T23:29:51.946Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.