Description

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T20:17:57.227Z",
  "pubdate": "2026-08-27T20:17:57.227Z",
  "executiveSummary": "A symbolic link (symlink) race condition vulnerability exists within Spring Integration's Zip/UnZip transformer components.\nThe vulnerability allows an unprivileged local user to redirect file output operations to an arbitrary directory by pre-creating a symlink at the predictable file path /tmp/ziptransformer.\nThis flaw impacts multiple versions of Spring Integration, including 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.\nSuccessful exploitation results in unauthorized file system modification, potentially leading to arbitrary file writes, data corruption, or information disclosure depending on the attacker's ability to manipulate the contents of the zip payload.\nThe attack requires local access to the host system and specifically targets the predictable, insecure use of a temporary directory. The risk is significant in multi-user environments where local unprivileged users can interact with the same file system as the application process.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of temporary file or directory handling within the Zip/UnZip transformer components of Spring Integration. The application assumes that the directory path /tmp/ziptransformer is safe for use and that it possesses exclusive control over this location.\nIn Unix-like environments, the /tmp directory is globally writable. Because the application logic relies on a static, predictable path (/tmp/ziptransformer) without verifying the nature of the file system object or ensuring exclusive creation rights, it becomes susceptible to symlink attacks.\nThe attack flow proceeds as follows: 1. An unprivileged local attacker anticipates the application's reliance on the /tmp/ziptransformer path. 2. Before the application initializes or executes its transformation logic, the attacker creates a symbolic link at /tmp/ziptransformer that points to a sensitive directory (e.g., a system configuration directory or a user-owned directory). 3. When the Zip/UnZip transformer executes, it attempts to write output files to /tmp/ziptransformer. 4. Due to the symlink, the operating system's file system API resolves the destination of the write operation to the attacker-defined target path rather than the intended temporary workspace.\nThis behavior constitutes an arbitrary file write primitive. If the application writes data controlled by the zip archive, an attacker can influence the content written to the target location. This could potentially lead to privilege escalation if the attacker can overwrite sensitive configuration files or inject executable code into paths monitored by other privileged processes.\nThe vulnerable component is the Zip/UnZip transformer logic. This flaw affects versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12. The vulnerability does not require authentication to the application itself, as the exploit vector is local to the host OS. Exploitation relies on the application process running with sufficient permissions to write to the attacker's chosen symlink target. Consequently, the impact is strictly limited to the file system context accessible to the account executing the Spring Integration process."
}