Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.8 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

• CVE-2022-27772: 0.60% estimated exploitation activity in the next 30 days; percentile 48.63 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. The vulnerable method is used to create a work directory for embedded web servers such as Tomcat and Jetty. The directory contains configuration files, JSP/class files, etc. If a local attacker got the permission to write in this directory, they could completely take over the application (ie. local privilege escalation). Impact Location This vulnerability impacted the following source location: \- https://github.com/spring-projects/spring-boot/blob/ce70e7d768977242a8ea6f93188388f273be5851/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/AbstractConfigurableWebServerFactory.java#L165-L177 This vulnerability exists because File.mkdir returns false when it fails to create a directory, it does not throw an exception. As such, the…

Published by the source

11 Jul 2022, 20:59 UTC

Last modified by the source

27 Jan 2023, 05:05 UTC

Source last checked

26 Oct 2026, 16:01 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-cm59-pr5q-cw85

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2022-27772

Advisory: Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
IDs: CVE-2022-27772, GHSA-cm59-pr5q-cw85
Record: https://patchnext.com/advisories/cve-2022-27772 (revision 1, source checked 26 Oct 2026, 16:01 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.springframework.boot:spring-boot 2.2.11.RELEASE. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.springframework.boot:spring-boot: affected <= 2.2.10.RELEASE; fixed in 2.2.11.RELEASE

## Suggested inspection (read-only)
- Maven org.springframework.boot:spring-boot: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.springframework.boot:spring-boot.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-cm59-pr5q-cw85 (GitHub-reviewed advisory GHSA-cm59-pr5q-cw85 lists affected ranges: Maven org.springframework.boot:spring-boot >=0 <=2.2.10.RELEASE)

Commands are suggestions: review each one before running it.