Spring Boot ApplicationTemp predictable temp directory ownership verification flaw

CVE-2026-40973 is a local attack vulnerability in Spring Boot's ApplicationTemp handling caused by use of a predictable temporary directory path together with insufficient validation of pre-existing filesystem objects. For a given application, the temporary directory name can remain predictable across restarts, and the vulnerable implementation accepted an existing path without adequately verifying that it was owned by the application's user. The provided context further indicates the code used Files.exists(path) without LinkOption.NOFOLLOW_LINKS, allowing symlinks to be followed transparently, and did not verify ownership before reuse. As a result, a local attacker on the same host can pre-create the expected directory or plant a symlink at that location before application startup or restart, causing the application to use an attacker-controlled location for temporary data. When persistent servlet sessions are enabled via server.servlet.session.persistent=true, this can expose persisted session data and, if malicious serialized data is introduced and later deserialized on restart, may lead to code execution as the application user. Affected versions are Spring Boot 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32; unsupported versions are also affected according to the vendor advisory.