Directory Traversal in Spring Boot Artemis Embedded Configuration

Executive Summary

CVE-2026-41001 is a medium-severity vulnerability in Spring Boot's Artemis auto-configuration. It arises because the ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured.

A local attacker on the same host can exploit this by pre-creating the predictable directory or placing a symlink before the application starts.

This can potentially allow the attacker to hijack message queue data, inject malicious messages, or execute code via deserialization attacks through the journal.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of a fixed, static path for the embedded Artemis message broker's data directory in Spring Boot applications when no explicit path is configured.

To detect this vulnerability on your system, you can check if your Spring Boot application is running a vulnerable version (2.7.0 through 4.0.6) and if the ArtemisEmbeddedConfigurationFactory is using the default static path for its data directory.

You can also inspect the filesystem for the presence of the predictable directory or any suspicious symlinks that might have been pre-created by a local attacker before the application starts.

• Check Spring Boot version: Use commands like `java -jar yourapp.jar --version` or check your build files (pom.xml or build.gradle) to identify the Spring Boot version.
• Locate the Artemis data directory: Identify the default data directory path used by ArtemisEmbeddedConfigurationFactory in your application configuration or logs.
• Check for pre-existing directories or symlinks: Run commands such as `ls -l /path/to/artemis/data/directory` to see if the directory exists and if it is a symlink.
• Verify ownership and permissions: Use `stat /path/to/artemis/data/directory` to check if the directory or symlink is owned by an unexpected user or has unusual permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a local attacker to hijack message queue data, which may lead to unauthorized access or manipulation of messages.

The attacker could also inject malicious messages into the queue or execute arbitrary code through deserialization attacks, potentially compromising the application or system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a local attacker to hijack message queue data or inject malicious messages, which could lead to unauthorized access or manipulation of sensitive information.

Such unauthorized access or data manipulation may result in non-compliance with data protection regulations like GDPR or HIPAA, which require safeguarding the confidentiality, integrity, and availability of sensitive data.

Therefore, organizations using affected Spring Boot versions without applying the fix risk violating these standards due to potential data breaches or integrity compromises.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade your Spring Boot application to a fixed version that addresses this vulnerability.

• Upgrade to Spring Boot versions 2.7.34, 3.3.20, 3.4.17, 3.5.15, or 4.0.7 (OSS) or their respective enterprise support versions.

Additionally, you can explicitly configure the ArtemisEmbeddedConfigurationFactory to use a non-predictable, unique data directory path to prevent attackers from pre-creating or symlinking the directory.

Ensure that the application runs with the least privileges necessary and that the filesystem permissions prevent unauthorized users from creating or modifying the Artemis data directory.

Useful 0 Not Useful 0