GHSA-jx2w-vp7f-456q

Suggest an improvement
Source
https://github.com/advisories/GHSA-jx2w-vp7f-456q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jx2w-vp7f-456q/GHSA-jx2w-vp7f-456q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jx2w-vp7f-456q
Aliases
Published
2026-04-08T19:14:32Z
Modified
2026-09-10T03:50:44Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Details

Summary

A path traversal vulnerability was discovered in the quarkus-openapi-generator extension

Details

The unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory.

The interesting thing is that the client module in the same repository already has the correct fix. OpenApiGeneratorStreamCodeGen.java at line 137 performs proper normalize() and startsWith() validation. The server module was simply missed.

PoC

This vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time.

  1. Create a ZIP file containing an entry named ../../proof.txt with arbitrary content
  2. Configure quarkus-openapi-generator to use the server (Apicurio) code generation path
  3. Serve the malicious ZIP from a controlled or MITM'd Apicurio registry endpoint
  4. Trigger code generation
  5. Observe that proof.txt is written two directories above the intended output

Impact

An attacker who can serve a crafted ZIP to the code generation pipeline could write arbitrary files on the build machine. This could overwrite source files, inject malicious code into the build output, or modify configuration files. In CI/CD environments, this could lead to supply chain compromise.

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-08T19:14:32Z",
    "nvd_published_at":  "2026-04-10T20:16:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / io.quarkiverse.openapi.generator:quarkus-openapi-generator

Package

Name
io.quarkiverse.openapi.generator:quarkus-openapi-generator
View open source insights on deps.dev
Purl
pkg:maven/io.quarkiverse.openapi.generator/quarkus-openapi-generator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.16.0

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
0.10.0
0.11.0
0.12.0
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
2.*
2.0.0
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.3.0
2.4.0
2.4.1
2.4.2
2.4.6
2.4.7
2.4.8
2.5.0
2.6.0
2.6.0-lts
2.7.0
2.7.0-lts
2.7.1
2.7.1-lts
2.8.0
2.8.0-lts
2.8.1
2.8.1-lts
2.8.2
2.8.2-lts
2.9.0
2.9.0-lts
2.9.1-lts
2.10.0
2.10.0-lts
2.11.0
2.11.0-lts
2.11.1-lts
2.12.0
2.12.0-lts
2.12.1
2.12.1-lts
2.13.0
2.13.0-lts
2.14.0
2.14.0-lts
2.15.0
2.15.0-lts

Database specific

last_known_affected_version_range 
"<= 2.15.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jx2w-vp7f-456q/GHSA-jx2w-vp7f-456q.json"