Link following in Spring Boot - CVE-2026-40977
Published: April 27, 2026
Vulnerability identifier: #VU128235
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-40977
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Spring
Affected software:
Spring Boot
Spring Boot
Detailed vulnerability description
The vulnerability allows a local privileged user to corrupt one file on the host.
The vulnerability exists due to improper link resolution in ApplicationPidFileWriter when writing the PID file at a predictable default path. A local privileged user can place a symlink at the PID file location to corrupt one file on the host.
Exploitation requires the application to be configured to use ApplicationPidFileWriter and requires write access to the PID file location.
How to mitigate CVE-2026-40977
Install security update from vendor's website.