PT-2026-20882 · Vmware · Spring Data Geode

Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-2817

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Data Geode (affected versions not specified)

Description The software has a flaw related to insecure directory usage during snapshot imports. Specifically, archives are extracted into predictable and overly permissive directories within the system's temporary location. This can lead to unauthorized access to cache data on shared hosts, as a local user with limited privileges may be able to access the extracted contents of another user's snapshot.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-378

CWE-538

CWE-379

Related Identifiers

CVE-2026-2817

Affected Products

Spring Data Geode

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2817 · Security Note
• https://twitter.com/VulmonFeeds/status/2024607167609704526 · Twitter Post
• https://twitter.com/CVEnew/status/2025892043000615121 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2026-2817 · Note
• https://t.me/CVEtracker/45168 · Telegram Post