CVE-2026-2817

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.

Score

CVSS 4.0 4.8 Medium

Status

Deferred - 36c7be3b-2937-45df-85ea-ca7133ea542c

Published

2026-02-19

Last modified

2026-02-20

Weaknesses

CWE-378, CWE-379, CWE-538

Affected products

• Spring Data Gemfire (Vmware)
• Spring Data Geode (Vmware)

References

• https://www.herodevs.com/vulnerability-directory/cve-2026-2817