CVE-2022-27772: Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
Summary
CVE-2022-27772: spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. Affects org.springframework.boot:spring-boot versions < 2.2.11.RELEASE. Fixed in 2.2.11.RELEASE. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework.boot:spring-boot package is a popular open-source framework for building Java applications. It provides a comprehensive set of tools and libraries for developing and deploying Spring-based applications. This vulnerability affects versions prior to v2.2.11.RELEASE of the package. The vulnerability arises from a race condition in the creation of temporary directories used by embedded web servers such as Tomcat and Jetty. If a local attacker gains permission to write in the temporary directory, they can exploit this vulnerability to escalate their privileges and potentially take control of the application.
Vulnerability Detail
The vulnerability in org.springframework.boot:spring-boot arises from the createTempDir method in the AbstractConfigurableWebServerFactory class. The method is responsible for creating a temporary directory for embedded web servers. However, due to a race condition, an attacker can delete the temporary file created by the method and quickly create their own directory with the same name before the web server does. This allows the attacker to gain control over the directory and write or read any files within it. The impact of this vulnerability is local privilege escalation, where an attacker with limited permissions can gain elevated privileges within the application.
How To Fix
Latest published version: 4.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.11.RELEASE
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to set the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user. This ensures that the temporary directory used by the application is not shared with other users, mitigating the risk of temporary directory hijacking. Users can set the environment variable by modifying their system configuration or by specifying it when running the application.
Conclusion
The vulnerability in org.springframework.boot:spring-boot allows a local attacker to hijack the temporary directory used by embedded web servers and escalate their privileges within the application. To fix the vulnerability, users should update their package to version v2.2.11.RELEASE or any subsequent version. A workaround is to set the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.boot:spring-boot →
FAQ
The vulnerability allows a local attacker to escalate their privileges within the application. This means that an attacker with limited permissions can gain elevated privileges and potentially take control of the application.
Versions prior to v2.2.11.RELEASE of org.springframework.boot:spring-boot are affected by this vulnerability.
To fix the vulnerability, update your org.springframework.boot:spring-boot package to version v2.2.11.RELEASE or any subsequent version.
Yes, you can set the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user to mitigate the risk of temporary directory hijacking.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities in software.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot.
