PT-2026-32035 · Red Hat · Quarkus-Openapi-Generator

Oscerd · Published 2026-04-08 · Updated 2026-05-21 · CVE-2026-40180

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Quarkus OpenAPI Generator versions prior to 2.16.0 and 2.15.0-lts

Description The unzip() method in ApicurioCodegenWrapper.java does not validate that the file path of extracted ZIP entries remains within the intended output directory. The destination file path is constructed using new File(toOutputDir, entry.getName()) without proper validation. A malicious ZIP archive containing path traversal sequences (e.g., ../../malicious.java) could allow writing files outside the target directory. This could lead to overwriting source files, injecting malicious code, or modifying configuration files, potentially resulting in a supply chain compromise.

Recommendations Update to version 2.16.0 or 2.15.0-lts.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40180

GHSA-JX2W-VP7F-456Q

Affected Products

Quarkus-Openapi-Generator

References · 9

• 🔥 https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q · Exploit
• https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239 · Patch
• https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40180 · Security Note
• https://osv.dev/vulnerability/GHSA-jx2w-vp7f-456q · Vendor Advisory
• https://github.com/quarkiverse/quarkus-openapi-generator · Note
• https://twitter.com/VulmonFeeds/status/2042715409963462735 · Twitter Post
• https://twitter.com/CVEnew/status/2042710179918000196 · Twitter Post
• https://t.me/cveNotify/164443 · Telegram Post