CVE-2026-2818CWE-23

Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)

High · published February 20, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-02-20T16:03Z
EPSS history
Timeline
  • 20 FEB 16:03Z
    Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)
    cvelistv5