CVE-2026-59311: Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Prevent symlink pre-creation by configuring the transformer to write to an unpredictable/non-shared work directory instead of a fixed path (/tmp/ziptransformer).
Zip/UnZip transformer (work directory) /tmp/ziptransformer work directory = Use a non-predictable, application-specific directory that is not located at /tmp/ziptransformer
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the Zip/UnZip transformer in the listed Spring Integration releases are exposed when an unprivileged local user can access the same host and create entries under /tmp before the application starts.
What does an attacker need to exploit it?
The attacker needs local unprivileged access on the host and must pre-create /tmp/ziptransformer as a symbolic link before the affected application starts. Exploitation does not require user interaction.
What is the impact of successful exploitation?
A successful attacker can redirect all Zip/UnZip transformer output to a directory they choose. The supplied severity vector indicates impacts to integrity and availability, with no stated confidentiality impact.
Which releases are identified as affected?
The affected releases listed are Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12.