Skip to content
Sign in
4.4 Medium

CVE-2026-2817 Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive…

Description

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.

Affected products and versions

Product Affected versions Fixed in
Spring Data Geode 2.0 2.0.0.RELEASE → 2.7.18 No fix stated
Spring Data Gemfire 1.7 1.7.0.RELEASE → 2.2.13.RELEASE No fix stated

Other CVEs of Spring Data Geode

The 2 CVEs of Spring Data Geode →
CVE-2026-2818 A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write… 8.2 High
Track this CVE