CVE-2026-40973: Spring Boot Predictable Temp Directory Vulnerability
Summary
CVE-2026-40973: Spring Boot accepts predictable temp directory without ownership verification. Affects org.springframework.boot:spring-boot across 5 version ranges.
< 2.7.32
>= 3.3.0, <= 3.3.18
>= 3.4.0, <= 3.4.15
>= 3.5.0, < 3.5.14
>= 4.0.0, < 4.0.6
Fixed in 2.7.32, 3.5.14 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Boot is a popular framework for building Java-based applications. It simplifies the development process by providing a range of features such as embedded servers, auto-configuration, and production-ready metrics. However, certain versions of Spring Boot are vulnerable to a security issue that allows local attackers to exploit predictable temporary directories, potentially leading to session hijacking and unauthorized code execution.
Vulnerability Detail
The vulnerability arises from Spring Boot's acceptance of a predictable temporary directory without proper ownership verification. When the configuration option 'server.servlet.session.persistent' is set to true, a local attacker on the same host can manipulate the temporary directory used by the application. This could allow the attacker to read sensitive session information, hijack authenticated user sessions, or deploy malicious code as the application's user. The affected versions include Spring Boot 4.0.0 to 4.0.5, 3.5.0 to 3.5.13, 3.4.0 to 3.4.15, 3.3.0 to 3.3.18, and 2.7.0 to 2.7.32.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.322.7.32 -
>= 3.5.0, < 3.5.143.5.14 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling session persistence by setting 'server.servlet.session.persistent' to false in your application properties. This will prevent the application from using the vulnerable temporary directory configuration.
Conclusion
In summary, CVE-2026-40973 is a significant vulnerability in certain versions of Spring Boot that allows local attackers to exploit predictable temporary directories. It is crucial to update to the latest patched versions to mitigate the risk of session hijacking and unauthorized code execution.
See every vulnerability recorded for org.springframework.boot:spring-boot →
FAQ
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
Affected versions include Spring Boot 4.0.0 to 4.0.5, 3.5.0 to 3.5.13, 3.4.0 to 3.4.15, 3.3.0 to 3.3.18, and 2.7.0 to 2.7.32.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider disabling session persistence as a temporary workaround.
The potential consequences include session hijacking, unauthorized access to sensitive information, and the ability to execute arbitrary code as the application's user.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot.
