CVE-2026-2817

Overview

Spring Data Geode and Spring Data GemFire provide Spring-based configuration and programming model support for Apache Geode and Pivotal GemFire, respectively.

‍

An insecure temporary directory usage vulnerability (CVE-2026-2817) has been identified in Spring Data Geode/Gemfire, where archive-based snapshots are expanded to a predictable, world-readable location in the system temporary directory.

‍

This issue affects multiple versions of Spring Data Geode.

‍

Details

Module Info

• Product: Spring Data Geode
• Affected packages: spring-data-geode, spring-data-gemfire
• Affected versions: >=1.7.0 <=2.2.13, >=2.0.0 <=2.7.18
• GitHub repository: https://github.com/spring-projects/spring-data-geode
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-geode
• Package manager: Maven
• Fixed in: NES for Spring Data Geode

‍

Vulnerability Info

This medium-severity vulnerability affects the snapshot import feature of the spring-data-geode package.

‍

When a ZIP or JAR archive is provided for snapshot import, the library extracts its contents to a temporary directory using a predictable name derived from the archive filename with default system permissions (typically world-readable). No cleanup of extracted files is performed after import. This enables a local user to enumerate predictable temp directory names and read sensitive Geode/GemFire cache data exported by another user on the same system.

‍

Mitigation

Spring Data Geode and Spring Data GemFire have reached end-of-life and are no longer community-supported. Affected users should leverage a commercial support partner like HeroDevs for post-EOL security support through NES for Spring.

‍

Users of the affected components should apply one of the following mitigations:

• Set the Java temp directory -Djava.io.tmpdir to a user-private directory.
• Also best practice to clean up temporary snapshot directories immediately after imports.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Jonathan Leitschuh (@JLLeitschuh)

‍