Spring Boot's ArtemisEmbeddedConfigurationFactory assigns a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. By doing so, the attacker can redirect where the broker stores data, potentially corrupting messages or directing data to an attacker‑controlled location, thereby compromising the integrity of broker data.

Affecting Spring Boot versions 2.7.0 through 2.7.33, 3.3.0 through 3.3.19, 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. Only the Spring Boot framework is impacted.

The threat requires local access and the EPSS score of <1% with no listing in CISA KEV indicates limited real‑world exploitation. An attacker would need the ability to create or symlink the predetermined directory, typically requiring file‑system permissions on the host. Success would allow the attacker to overwrite or redirect the broker’s data directory, undermining data integrity. The CVSS score of 5.3 denotes a moderate severity.