CVE-2026-2818

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Score

CVSS 3.1 8.2 High

Status

Deferred - 36c7be3b-2937-45df-85ea-ca7133ea542c

Published

2026-02-20

Last modified

2026-07-15

Weaknesses

CWE-22, CWE-23

Affected products

• Jboss Fuse (Redhat)
• Spring Data Gemfire (Vmware)
• Spring Data Geode (Vmware)

References

• https://www.herodevs.com/vulnerability-directory/cve-2026-2818
• https://access.redhat.com/security/cve/CVE-2026-2818
• https://bugzilla.redhat.com/show_bug.cgi?id=2441384
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2818.json