CVE-2026-2818

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2818
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2818.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2818
Published
2026-02-20T16:03:21Z
Modified
2026-08-12T03:51:26Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CVSS Calculator
Summary
Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)
Details

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Database specific 
{
    "cna_assigner": "HeroDevs",
    "cwe_ids": [
        "CWE-23"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2818.json"
}
References

Affected packages

Git / github.com/spring-attic/spring-data-gemfire

Affected ranges

Type
GIT
Repo
https://github.com/spring-attic/spring-data-gemfire
Events
Introduced
88434d05a4f304f6ff6d6b03362f290e9d8011b3
Last Affected
f3fbd3fa7805002b31dec4a6ea1a0cb43c9acf3e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.7.0.RELEASE"
        },
        {
            "last_affected": "2.2.13.RELEASE"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.7.0.RELEASE
1.8.0.M1
1.8.0.RC1
1.8.0.RELEASE
1.9.0.M1
2.*
2.0.0.M1
2.0.0.M2
2.0.0.M3
2.0.0.M4
2.0.0.RC1
2.0.0.RC2
2.0.0.RC3
2.0.0.RELEASE
2.1.0.M1
2.1.0.M2
2.1.0.M3
2.1.0.RC1
2.1.0.RC2
2.1.0.RELEASE
2.2.0.M1
2.2.0.M2
2.2.0.M3
2.2.0.M4
2.2.0.RC1
2.2.0.RC2
2.2.0.RC3
2.2.0.RELEASE
2.2.1.RELEASE
2.2.10.RELEASE
2.2.11.RELEASE
2.2.12.RELEASE
2.2.13.RELEASE
2.2.2.RELEASE
2.2.3.RELEASE
2.2.4.RELEASE
2.2.5.RELEASE
2.2.6.RELEASE
2.2.7.RELEASE
2.2.8.RELEASE
2.2.9.RELEASE

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2818.json"

Git / github.com/spring-attic/spring-data-geode

Affected ranges

Type
GIT
Repo
https://github.com/spring-attic/spring-data-geode
Events
Introduced
bd51bdeba019f0dc17a0db198b7a13e94ab1a84c
Last Affected
fe693f4b83eea80ef8ee5e1fd6e6f22e9531b888
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.0.0.RELEASE"
        },
        {
            "last_affected": "2.7.18"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*
2.0.0.RELEASE
2.1.0.M1
2.1.0.M2
2.1.0.M3
2.1.0.RC1
2.1.0.RC2
2.1.0.RELEASE
2.2.0.M1
2.2.0.M2
2.2.0.M3
2.2.0.M4
2.2.0.RC1
2.2.0.RC2
2.2.0.RC3
2.2.0.RELEASE
2.3.0.M1
2.3.0.M2
2.3.0.M3
2.3.0.M4
2.3.0.RC1
2.3.0.RC2
2.3.0.RELEASE
2.4.0
2.4.0-M1
2.4.0-M2
2.4.0-RC1
2.4.0-RC2
2.5.0
2.5.0-M1
2.5.0-M2
2.5.0-M3
2.5.0-M4
2.5.0-M5
2.5.0-RC1
2.6.0
2.6.0-M1
2.6.0-M2
2.6.0-M3
2.6.0-RC1
2.7.0
2.7.0-M1
2.7.0-M2
2.7.0-M3
2.7.0-M4
2.7.0-RC1
2.7.1
2.7.10
2.7.11
2.7.12
2.7.13
2.7.14
2.7.15
2.7.16
2.7.17
2.7.18
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2818.json"