8.2
High
CVE-2026-2818 A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write…
Description
A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Fuse 7 | Versions not published | |
| Spring Data Geode 2.0 | 2.0.0.RELEASE → 2.7.18 | No fix stated |
| Spring Data Gemfire 1.7 | 1.7.0.RELEASE → 2.2.13.RELEASE | No fix stated |
References
- www.herodevs.com www.herodevs.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Fuse 7
The 219 CVEs of Red Hat Fuse 7 →
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High
CVE-2026-93998
Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
7.4
High
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Medium