CVE-2026-2818

8.2 highEPSS 0.3%

High (8.2). EPSS 0.3% chance of exploitation in the next 30 days.

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWEs: CWE-23, CWE-22
Published: 2026-02-20
Modified: 2026-07-15
Record from: the NVD, synced 2026-10-19

References

https://www.herodevs.com/vulnerability-directory/cve-2026-2818
https://access.redhat.com/security/cve/CVE-2026-2818
https://bugzilla.redhat.com/show_bug.cgi?id=2441384
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2818.json

Check your stack JSON