CVE-2026-40973

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40973
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40973.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40973
Aliases
Downstream
Related
Published
2026-04-27T23:29:51.946Z
Modified
2026-07-15T01:49:13.962501012Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40973.json",
    "cna_assigner": "vmware",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.6"
                },
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.14"
                },
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.16"
                },
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.19"
                },
                {
                    "introduced": "2.7.0"
                },
                {
                    "fixed": "2.7.33"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-377"
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-boot

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-boot
Events
Introduced
8c2d6453243f319accaef7a190ff8ddf89f482a2
Fixed
7d7b3ac12735161f9c096ce6cb415bdd9fc4a0f4
Introduced
1c0e08b4c434b0e77a83098267b2a0f5a3fc56d7
Fixed
8821ad2cd381bb4b9615a61479e1de7305a8ba39
Database specific 
{
    "cpe": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.6"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40973.json"