Spring Boot's ArtemisEmbeddedConfigurationFactory assigns a fixed, static path for the embedded Artemis message broker’s data directory when no explicit path is provided. This predictable directory allows a local attacker on the same host to create or symlink the directory before the application starts. By doing so, the attacker can redirect where the broker stores data, potentially corrupting messages or directing data to an attacker‑controlled location. The issue affects the integrity of broker data.

Affecting Spring Boot versions 2.7.0 through 2.7.33, 3.3.0 through 3.3.19, 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. Only the Spring Boot framework is impacted.

The CVSS score of 5.3 denotes moderate severity. Exploitation requires local access and the EPSS score of <1% with no listing in CISA KEV indicates limited real‑world exploitation. The issue is associated with CWE-1188 and CWE-377. An attacker would need the ability to create or symlink the predetermined directory, typically requiring file‑system permissions on the host. Success would allow the attacker to overwrite or redirect the broker’s data directory, undermining data integrity.