What’s Vulnerable › Vulnerabilities

CVE-2026-2817: Spring Data Geode Insecure Temporary Directory Usage

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-19 · updated 2026-06-17
• Weakness: CWE-378

Description

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.

Affected products

• VMware Spring Data Gemfire: from 1.7.0.RELEASE through 2.2.13.RELEASE
• VMware Spring Data Geode: from 2.0.0.RELEASE through 2.7.18

References

• https://www.herodevs.com/vulnerability-directory/cve-2026-2817

Get alerted when CVE-2026-2817 or the next vulnerability affects your stack