What’s Vulnerable › Vulnerabilities

CVE-2021-26719

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-09 · updated 2026-06-17
• Weakness: CWE-22

Description

A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.

Affected products

• gradle Enterprise Test Distribution Agent: before 1.3.2 — fixed in 1.3.2
• gradle Maven: from 1.8 through 1.8.1
• gradle Test Distribution: before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: gradle Enterprise Test Distribution Agent 1.3.2; gradle Test Distribution 1.3.2. Check the vendor advisory for mitigations.

References

• https://security.gradle.com/advisory/CVE-2021-26719
• https://security.gradle.com/advisory/CVE-2021-26719

Get alerted when CVE-2021-26719 or the next vulnerability affects your stack