PT-2026-21245 · Vmware · Spring Data Geode

Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-2818

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Data Geode (affected versions not specified)

Description A zip-slip path traversal flaw exists in the import snapshot functionality of Spring Data Geode. This issue allows attackers to write files outside the intended extraction directory by crafting malicious archive files (ZIP files). The vulnerability appears to be susceptible on Windows OS only. The flaw could potentially lead to overwriting critical system files or sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-2818

Affected Products

Spring Data Geode

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2818 · Security Note
• https://twitter.com/TheHackerWire/status/2024901415064535353 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2026-2818 · Note
• https://twitter.com/CveTodo/status/2024901869206651300 · Twitter Post
• https://t.me/CVEtracker/45296 · Telegram Post
• https://twitter.com/CVEnew/status/2024988804508254544 · Twitter Post