Skip to content
OpenAdvisories
Low · 3.2 CVE-2026-59292 EUVD-2026-67180GHSA-5xq7-3cgg-j383

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

Published Aug 27, 2026 · Updated Aug 28, 2026 · Assigned by vmware

Description

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier

Affected products

VendorProductAffectedFixed
Spring Spring Integration 7.1.0, 7.0.0 – ≤ 7.0.5, 6.5.0 – ≤ 6.5.10, 6.4.0 – ≤ 6.4.12, ≤ 5.5.21 —

References