THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-41001 (MEDIUM 5.3) — Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the appl

[NVD] CVE-2026-41001 (MEDIUM 5.3) — Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the appl

lownvdPublished 2026-06-11

CVE-2026-41001 CVSS: 5.3 MEDIUM Published: 2026-06-11T07:16:28.163

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.

Affected versions: Spring Boot 4.0.

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-41001