CVE-2022-27772 Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot

What is CVE-2022-27772?

CVE-2022-27772 is a high-severity path traversal vulnerability in n/a, published on 30 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer

Weakness: CWE-668

Which versions are affected by CVE-2022-27772?

2 open source packages ship an affected version, including org.springframework.boot:spring-boot. It affects 1 product.

Products include Vmware Spring Boot.

How do I fix CVE-2022-27772?

Upgrade org.springframework.boot:spring-boot to 2.2.11.RELEASE or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-27772 being exploited?

There is no known exploitation of CVE-2022-27772 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-20873 Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry Critical 9.8
• CVE-2026-40976 Spring Boot's default security filter chain has no authorization rule with Actuator but without Health Critical 9.1
• CVE-2026-22731 Authentication Bypass under Actuator Health groups paths High 8.2
• CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints High 8.2
• CVE-2026-40972 Spring Boot DevTools remote secret comparison is vulnerable to timing attacks High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cm59-pr5q-cw85.