CVE-2026-2818

HighCVSS 8.2/10Last modified Jul 15, 2026

Description

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-23CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jul 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-281805.3Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.CVE-2026-281816.5Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-281826.5Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-281837.2Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege EscalatiCVE-2026-281859.8Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.CVE-2026-281868.1Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.CVE-2026-281877.1Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.CVE-2026-281887.3Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-281897.4Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.CVE-2026-28196.3A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /wCVE-2026-281907.1Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.CVE-2026-281918.8Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a throug
CVE-2026-2818: High severity, CVSS 8.2 | Vulnix