CVE-2026-2818: Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-20 · updated 2026-07-15
Weakness: CWE-23

Description

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Affected products

VMware Spring Data Gemfire: from 1.7.0.RELEASE through 2.2.13.RELEASE
VMware Spring Data Geode: from 2.0.0.RELEASE through 2.7.18

References

https://www.herodevs.com/vulnerability-directory/cve-2026-2818
https://access.redhat.com/security/cve/CVE-2026-2818
https://bugzilla.redhat.com/show_bug.cgi?id=2441384
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2818.json

Get alerted when CVE-2026-2818 or the next vulnerability affects your stack