Spring Boot applications that enable persistent sessions and rely on the default ApplicationTemp location can be compromised by a local attacker who has file system access on the same host. By controlling the contents of the temporary directory, the attacker can read or modify session data, enabling hijack of authenticated users. If the attacker can also inject a gadget chain into that directory, code execution under the application’s user account becomes possible. The weakness is characterized by CWE-341 and CWE-377, reflecting both predictable data usage and improper control of code and data generation.

The vulnerability affects Spring:Spring Boot versions 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32. The fix was introduced in Spring Boot 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33, respectively. Any releases beyond those ranges, including older unsupported versions, may also be impacted.

The CVSS score of 7 classifies this issue as a high‑severity vulnerability, yet the exploit probability remains low, with an EPSS score of < 1%, and the vulnerability is not in the CISA KEV catalogue. Attacks require local host access, the application to have persistent sessions enabled, and the ability to read or modify the ApplicationTemp directory. Consequently, the primary threat is limited to environments where an attacker already has foothold on the same machine, but the damage—session hijacking, credential theft, and possible application‑level code execution—can be severe.