PropertiesPersistingMetadataStore, the default file‑based metadata store in Spring Integration, writes its state to a file named metadata‑store.properties in the temporary directory (${java.io.tmpdir}/spring‑integration). The file is created with world‑readable permissions, allowing any user or process on the affected host to read the contents. This represents an information disclosure vulnerability flagged as CWE‑732.

Spring Integration distributed by Spring. The vulnerability affects the following released versions: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; and 5.5.21 and all earlier releases.

The CVSS base score of 3.2 indicates low severity. The EPSS score of 0.00144 reveals a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local file read: any user or process with access to the host’s temporary directory can read the metadata‑store.properties file placed in ${java.io.tmpdir}/spring‑integration, exposing the application’s stored state.