Zip Slip Path Traversal on Node Unpack
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 14.2.0 – 14.14.0; 15.0.0 – 23.6.6; 24.0.0 – 24.9.8; 25.0.0 – 25.0.2 | — | No fix listed | CNA |
| Vaadin | flow | 2.2.0 – 2.13.0; 3.0.0 – 23.6.7; 24.0.0 – 24.9.9 | — | No fix listed | CNA |
| Vaadin | flow | 25.0.0 – 25.0.3 | — | No fix listed | CNA |
| — | com.vaadin:flow-project (Maven) | 14.2.0 to before 14.14.1 | 14.14.1 | Patch available | GHSA-8jrh-7jg8-fvmv |
| — | com.vaadin:flow-project (Maven) | 23.0.0 to before 23.6.7 | 23.6.7 | Patch available | GHSA-8jrh-7jg8-fvmv |
| — | com.vaadin:flow-project (Maven) | 24.0.0 to before 24.9.9 | 24.9.9 | Patch available | GHSA-8jrh-7jg8-fvmv |
| — | com.vaadin:flow-project (Maven) | 25.0.0 to before 25.0.3 | 25.0.3 | Patch available | GHSA-8jrh-7jg8-fvmv |
- vaadin VendorVaadin Affected 14.2.0 – 14.14.0; 15.0.0 – 23.6.6; 24.0.0 – 24.9.8; 25.0.0 – 25.0.2 Fixed in — No fix listed CNA
- flow VendorVaadin Affected 2.2.0 – 2.13.0; 3.0.0 – 23.6.7; 24.0.0 – 24.9.9 Fixed in — No fix listed CNA
- flow VendorVaadin Affected 25.0.0 – 25.0.3 Fixed in — No fix listed CNA
- com.vaadin:flow-project (Maven) Vendor— Affected 14.2.0 to before 14.14.1 Fixed in 14.14.1 Patch available GHSA-8jrh-7jg8-fvmv
- com.vaadin:flow-project (Maven) Vendor— Affected 23.0.0 to before 23.6.7 Fixed in 23.6.7 Patch available GHSA-8jrh-7jg8-fvmv
- com.vaadin:flow-project (Maven) Vendor— Affected 24.0.0 to before 24.9.9 Fixed in 24.9.9 Patch available GHSA-8jrh-7jg8-fvmv
- com.vaadin:flow-project (Maven) Vendor— Affected 25.0.0 to before 25.0.3 Fixed in 25.0.3 Patch available GHSA-8jrh-7jg8-fvmv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 14.2.0 to before 14.14.1; 15.0.0 to before 23.6.7; 24.0.0 to before 24.9.10; 25.0.0 to before 25.0.4 | Vulnerable | Vaadin |
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.2.0 to before 14.14.1; 15.0.0 to before 23.6.7; 24.0.0 to before 24.9.10; 25.0.0 to before 25.0.4 Vulnerable ·Vaadin
Remediation
- Fix · GHSA-8jrh-7jg8-fvmv com.vaadin:flow-project (Maven) Fixed in 14.14.1 Advisory →
- Fix · GHSA-8jrh-7jg8-fvmv com.vaadin:flow-project (Maven) Fixed in 23.6.7 Advisory →
- Fix · GHSA-8jrh-7jg8-fvmv com.vaadin:flow-project (Maven) Fixed in 24.9.9 Advisory →
- Fix · GHSA-8jrh-7jg8-fvmv com.vaadin:flow-project (Maven) Fixed in 25.0.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2741
- 2026-10-03 Alias added: GHSA-8jrh-7jg8-fvmv
References
Patch 5
More Vaadin vulnerabilities
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
- TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
- TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
- TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-2741 · CVE Program
- CVE-2026-2741 · NVD
- FIRST EPSS
- GHSA-8jrh-7jg8-fvmv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2741 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences