CVE-2026-2817CWE-378CWE-379CWE-538
Spring Data Geode Insecure Temporary Directory Usage
Medium · published February 19, 2026
What it is
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
The record
Technical detail
- CVSS v4.0
- 4.8 · MEDIUM
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00155 · 4.2th percentile
- Weaknesses
- CWE-378 · Creation of Temporary File With Insecure Permissions; CWE-379 · Creation of Temporary File in Directory with Insecure Permissions; CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
- Published
- 2026-02-19T17:18Z
EPSS history
Timeline