Spring Boot’s ArtemisEmbeddedConfigurationFactory assigns a fixed, static path to the embedded Artemis message broker’s data directory when no explicit path is configured. A local attacker who can create that directory before the application starts can either pre‑populate a predictable directory or place a symlink in its place. This allows the attacker to influence the broker’s data storage or potentially inject malicious data. The resulting compromise is limited to the local host and can affect confidentiality or integrity of messages handled by Artemis.

Vendors: Spring. Product: Spring Boot. Affected versions include Spring Boot 2.7.0 through 2.7.33, 3.3.0 through 3.3.19, 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires local access; the absence of a public EPSS score and lack of KEV listing suggest the exploit has not yet been widely observed. Nonetheless, an attacker with local privileges can execute the described attack path by creating or symlinking the expected directory before the application launches, leading to potential data tampering or unauthorized configuration changes.