CVE-2026-2818
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
A zip-slip path traversal vulnerability in Spring Data for Apache Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.
This high-severity vulnerability (CVE-2026-2818) affects the snapshot import feature on Windows in multiple published versions of Spring Data for Apache Geode and Spring Data GemFire.
Details
Module Info
- Product: Spring Data Geode
- Affected packages: spring-data-geode, spring-data-gemfire
- Affected versions: >=1.7.0 <=2.2.13, >=2.0.0 <=2.7.18
- GitHub repository: https://github.com/spring-projects/spring-data-geode
- Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-geode
- Package manager: Maven
- Fixed in: NES for Spring Data Geode
Vulnerability Info
This vulnerability affects the snapshot import feature of the spring-data-geode package.
The library's filename sanitization logic relies on the platform's native path separator to strip directory components from ZIP entry names. On Linux and macOS, the native separator (/) matches the ZIP specification and sanitization works correctly. On Windows, the native separator (\) does not match the forward slashes used in ZIP entries, so path traversal sequences like ../../../../ pass through undetected. An attacker who can supply a crafted archive for snapshot import can write files to arbitrary locations accessible by the application, potentially leading to code execution, data corruption, or persistence via startup scripts.
An application can be vulnerable if the following are true:
- The application must be running on Windows
- The victim must import an attacker-controlled ZIP or JAR archive
- The application must have write permissions to the target paths
This issue affects multiple versions of Spring Data Geode.
Mitigation
Spring Data Geode and Spring Data GemFire have reached end-of-life and are no longer community-supported. Affected users should leverage a commercial support partner like HeroDevs for post-EOL security support through NES for Spring.
As interim workarounds:
- Validate the integrity and origin of all snapshot archives before importing.
- Avoid importing snapshot archives from untrusted sources.
- Run the application with minimal filesystem permissions to limit the impact of arbitrary file writes.
Credits
- Joe Kuhel from HeroDevs
