CVE-2026-59311
published 2026-08-27CVE-2026-59311: A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer…
PriorityP337medium6.8CVSS 3.1
AVNACHPRLUINSUCNIHAH
EPSS
0.35%
28.2th percentile
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_integration | — | — |
| spring | spring_integration | 6.4.0 – 6.4.12 | — |
| spring | spring_integration | 6.5.0 – 6.5.10 | — |
| spring | spring_integration | 7.0.0 – 7.0.5 | — |
| vmware | spring_integration | — | — |
| vmware | spring_integration | — | — |
| vmware | spring_integration | — | — |
| vmware | spring_integration | — | — |
| vmware | spring_integration | — | — |
| vmware | spring_integration | 6.4.0 – 6.4.12 | — |
| vmware | spring_integration | 6.5.0 – 6.5.10 | — |
| vmware | spring_integration | 7.0.0 – 7.0.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application star
ghsa_unreviewed·2026-08-27
CVE-2026-59311 [MEDIUM] CWE-59 A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application star
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
VulDB
VMware Spring Integration up to 6.4.12/6.5.10/7.0.5/7.1.0 ZipTransformer link following
vuldb·2026-08-27·CVSS 6.8
CVE-2026-59311 [MEDIUM] VMware Spring Integration up to 6.4.12/6.5.10/7.0.5/7.1.0 ZipTransformer link following
A vulnerability classified as problematic was found in VMware Spring Integration up to 6.4.12/6.5.10/7.0.5/7.1.0. This affects an unknown function of the component ZipTransformer. Executing a manipulation can lead to link following.
This vulnerability is tracked as CVE-2026-59311. The attack is restricted to local execution. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published