{"id":"CVE-2026-2818","state":"PUBLISHED","title":"Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)","description":"A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.","publishedAt":"2026-02-20T16:03:21.032Z","updatedAt":"2026-07-15T01:12:00.937Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","source":"HeroDevs"},"assigner":"HeroDevs","products":["VMware Spring Data Geode","VMware Spring Data Gemfire"],"affected":[{"vendor":"VMware","product":"Spring Data Geode","packageName":"org.springframework.data:spring-data-geode","defaultStatus":"unaffected","versions":[{"version":"2.0.0.RELEASE","status":"affected","lessThanOrEqual":"2.7.18","versionType":"maven"}],"repo":"https://github.com/spring-attic/spring-data-geode"},{"vendor":"VMware","product":"Spring Data Gemfire","packageName":"org.springframework.data:spring-data-gemfire","defaultStatus":"unaffected","versions":[{"version":"1.7.0.RELEASE","status":"affected","lessThanOrEqual":"2.2.13.RELEASE","versionType":"maven"}],"repo":"https://github.com/spring-attic/spring-data-gemfire"}],"references":["https://www.herodevs.com/vulnerability-directory/cve-2026-2818","https://access.redhat.com/security/cve/CVE-2026-2818","https://bugzilla.redhat.com/show_bug.cgi?id=2441384","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2818.json"],"weaknesses":["CWE-23","CWE-22"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2818.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2818","state":"PUBLISHED","datePublished":"2026-02-20T16:03:21.032Z","dateUpdated":"2026-07-15T01:12:00.937Z","assignerShortName":"HeroDevs","assignerOrgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateReserved":"2026-02-19T17:07:41.627Z"},"containers":{"cna":{"title":"Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)","descriptions":[{"lang":"en","value":"A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only."}],"affected":[{"vendor":"VMware","product":"Spring Data Geode","packageName":"org.springframework.data:spring-data-geode","defaultStatus":"unaffected","versions":[{"version":"2.0.0.RELEASE","status":"affected","lessThanOrEqual":"2.7.18","versionType":"maven"}],"repo":"https://github.com/spring-attic/spring-data-geode"},{"vendor":"VMware","product":"Spring Data Gemfire","packageName":"org.springframework.data:spring-data-gemfire","defaultStatus":"unaffected","versions":[{"version":"1.7.0.RELEASE","status":"affected","lessThanOrEqual":"2.2.13.RELEASE","versionType":"maven"}],"repo":"https://github.com/spring-attic/spring-data-gemfire"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-2818"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","description":"CWE-23 Relative Path Traversal","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"HeroDevs","orgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateUpdated":"2026-02-20T16:03:21.032Z"},"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]},{"capecId":"CAPEC-139","descriptions":[{"lang":"en","value":"CAPEC-139 Relative Path Traversal"}]}],"source":{"discovery":"EXTERNAL"},"tags":["unsupported-when-assigned","x_open-source"],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-20T20:12:17.872342Z","id":"CVE-2026-2818","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-20T20:12:35.205Z"}},{"title":"org.springframework.data/spring-data-geode: Spring Data Geode: Path traversal vulnerability allows arbitrary file write via import snapshot functionality.","descriptions":[{"lang":"en","value":"A flaw was found in Spring Data Geode. This zip-slip path traversal vulnerability in the import snapshot functionality allows attackers to write files outside the intended extraction directory. This can lead to unauthorized modification of system files or the introduction of malicious content. This vulnerability primarily affects systems running on Windows operating systems."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"spring-data-geode","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2818","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441384","name":"RHBZ#2441384","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2818.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:12:00.937Z"},"datePublic":"2026-02-20T16:03:21.032Z","timeline":[{"lang":"en","time":"2026-02-20T17:03:16.830Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-02-20T16:03:21.032Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}