Spring Integration CVE-2026-59311

Exploitation requires a local unprivileged account on the same operating system host as the Spring Integration application - remote exploitation is not consistent with the description regardless of the AV:N CVSS metric, and defenders should treat this as a local-access vulnerability. The attack is specifically contingent on the application using the Zip/UnZip transformer component; Spring Integration deployments that do not use this transformer are not affected. The attacker must successfully create the /tmp/ziptransformer symlink before application startup, meaning a running application that already created its working directory as a legitimate directory is not immediately vulnerable without a restart. Exploitation is further limited to environments where untrusted local users coexist with the Spring Integration process, such as shared servers, multi-tenant containers without proper namespace isolation, or misconfigured CI/CD runners.

The vendor-assigned CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H contains a notable inconsistency: the AV:N (Network) metric conflicts directly with the description, which states this requires 'a local unprivileged user on the same host.' This is a significant discrepancy that defenders should verify with the vendor, as it inflates the apparent attack surface. Correcting AV to L (Local) more accurately reflects the exploitation model - the attacker requires local shell access to the same machine. AC:H is appropriate because the attacker must pre-create the symlink before application startup, introducing a timing dependency. PR:L correctly reflects that no elevated privileges are needed, only a local unprivileged account. The I:H and A:H impacts are plausible: redirecting transformer output can corrupt application state or cause data loss. No EPSS data, KEV listing, or POC is present in the available intelligence, indicating low observed exploitation pressure at this time. Real-world risk is primarily relevant in multi-tenant or shared-host deployments where untrusted local users coexist with Spring Integration processes.

An attacker with a low-privileged local account on the same host as a running Spring Integration application executes ln -s /attacker-controlled-dir /tmp/ziptransformer before the application starts. When the application subsequently processes Zip/UnZip transformations, all output files are silently written to the attacker-chosen directory rather than the intended destination, allowing the attacker to intercept processed data or overwrite files in that directory.