CVE-2026-59311
MediumCVSS 6.8Summary
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
Risk Assessment
An attacker can overwrite or replace files on the system, potentially leading to privilege escalation or data integrity compromise. It may also allow injection of malicious code.
Recommendation
It is recommended to upgrade Spring Integration to a patched version. Also avoid using predictable temporary paths or ensure secure directory creation.
Original NVD description (English source)
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12