What is CVE-2026-2818?

CVE-2026-2818 is a high-severity vulnerability in Vmware Spring Data Gemfire, classified under Relative Path Traversal. CVSS score: 8.2/10. Published 2026-02-20.

How severe is CVE-2026-2818?

High severity. CVSS v3 base score is 8.2 out of 10.

Path Traversal in Vmware Spring Data Gemfire

CVE-2026-2818

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

EPSS: 0.003 (19.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N.

Affected products

Vmware Spring Data Gemfire — versions 1.7.0.RELEASE
Vmware Spring Data Geode — versions 2.0.0.RELEASE

Weakness classification (CWE)

CWE-23 — Relative Path Traversal
CWE-22 — Path Traversal

References

36c7be3b-2937-45df-85ea-ca7133ea542c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Frequently asked questions

What is CVE-2026-2818?: CVE-2026-2818 is a high-severity vulnerability in Vmware Spring Data Gemfire, classified under Relative Path Traversal. CVSS score: 8.2/10. Published 2026-02-20.
How severe is CVE-2026-2818?: High severity. CVSS v3 base score is 8.2 out of 10.