PT-2026-24205 · Maven+2 · Com.Vaadin:Flow-Project+2

Published 2026-03-10 · Updated 2026-05-07 · CVE-2026-2741

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vaadin versions 14.2.0 through 14.14.0 Vaadin versions 23.0.0 through 23.6.6 Vaadin versions 24.0.0 through 24.9.8 Vaadin versions 25.0.0 through 25.0.2

Description A flaw exists in Vaadin that allows specially crafted ZIP archives to escape the intended extraction directory during Node.js download and extraction. This can occur when Vaadin’s build process automatically downloads and extracts Node.js if it is not already installed locally. An attacker who can intercept or control this download—through methods like DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack—could serve a malicious archive containing path traversal sequences. These sequences can then write files outside the intended extraction directory.

Recommendations Vaadin versions 14.2.0 through 14.14.0 should be upgraded to 14.14.1. Vaadin versions 23.0.0 through 23.6.6 should be upgraded to 23.6.7. Vaadin versions 24.0.0 through 24.9.8 should be upgraded to 24.9.9. Vaadin versions 25.0.0 through 25.0.2 should be upgraded to 25.0.3 or newer. Users of unsupported Vaadin versions 10-13 and 15-22 should update to the latest 14, 23, 24, or 25 version. Consider using a globally preinstalled Node.js version compatible with your Vaadin version.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2741

GHSA-8JRH-7JG8-FVMV

Affected Products

Com.Vaadin:Flow-Project

Flow

Vaadin

References · 14

• https://github.com/vaadin/flow/pull/23135 · Patch
• https://github.com/vaadin/flow/pull/23130 · Patch
• https://github.com/vaadin/flow/pull/23133 · Patch
• https://github.com/vaadin/flow/pull/23125 · Patch
• https://github.com/vaadin/flow/pull/23131 · Patch
• https://vaadin.com/security/cve-2026-2741 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8jrh-7jg8-fvmv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2741 · Security Note
• https://github.com/vaadin/flow · Note
• https://t.me/cveNotify/162615 · Telegram Post
• https://twitter.com/CVEnew/status/2034520453469917538 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034521845697745032 · Twitter Post
• https://t.me/CVEtracker/47004 · Telegram Post