What’s Vulnerable › Vulnerabilities

CVE-2026-40180: Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-10 · updated 2026-10-26
• Weakness: CWE-22

Description

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.

Affected products

• quarkiverse quarkus-openapi-generator: before 2.15.0; 2.15.0 — fixed in 2.15.0

How to fix

Upgrade to a fixed version: quarkiverse quarkus-openapi-generator 2.15.0. Check the vendor advisory for mitigations.

References

• https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0
• https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239
• https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q
• https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q

Get alerted when CVE-2026-40180 or the next vulnerability affects your stack