ZipTransformer builds the destination path for a created .zip archive using the value of the file_name header on a message. An attacker able to inject a crafted file_name can cause the resulting archive to be written to any filesystem path outside the configured work directory. This flaw is an instance of CWE‑73, External Control of File Name or Path, and allows overwriting or creating files without proper input validation, potentially leading to data loss, unintended disclosure, or corruption of critical configuration files. The vulnerability does not provide direct code execution but enables an attacker to manipulate the file system in ways that can affect application integrity.

Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12 are affected. The issue arises whenever ZipResultType.FILE (the default) is used in a ZipTransformer component exposed to external input.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and it is not listed in CISA's KEV catalog, suggesting no publicly known exploits yet. However, the attack vector requires an attacker who can send a message with a custom file_name header to the vulnerable ZipTransformer. If the integration endpoint is exposed without proper authentication or input validation, an attacker can exploit the flaw to write arbitrary files to the host filesystem, which could lead to unauthorized data disclosure or overwrite of important files. Monitoring for unusual outbound file writes and restricting access to message endpoints are prudent mitigations while a patch is applied.