CVE-2026-2818

Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)

State: Published
Severity: 8.2 High
Published: Feb 20, 2026
Updated: Jul 15, 2026
Reserved: Feb 19, 2026

Description

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N	HeroDevs
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	redhat-SADP

Weaknesses

CWE-23 Relative Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Spring Data GeodeVMware	2.0.0.RELEASE through 2.7.18Affected
Spring Data GemfireVMware	1.7.0.RELEASE through 2.2.13.RELEASEAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.