What is the CVSS score of CVE-2026-2818?

CVE-2026-2818 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by CVE-2026-2818?

Spring Data Geode's snapshot import feature contains a critical path traversal vulnerability (CVE-2026-2818) that could allow attackers to write malicious files to arbitrary locations on Windows…

How to fix or mitigate CVE-2026-2818?

Within 24 hours: Inventory all systems running Spring Data Geode, particularly Windows environments, and disable snapshot import functionality if not actively required. Within 7 days: Implement network segmentation to restrict access to snapshot import APIs and monitor for suspicious file write activities. Within 30 days: Monitor Spring Data Geode security advisories for patch availability and establish a deployment plan; conduct a forensic review of snapshot import logs for any unauthorized activity.

Java CVE-2026-2818

HIGH

Relative Path Traversal (CWE-23)

2026-02-20 36c7be3b-2937-45df-85ea-ca7133ea542c

Path Traversal Microsoft Java

8.2

CVSS 3.1 · Vendor: 36c7be3b-2937-45df-85ea-ca7133ea542c

Severity by source

Vendor (36c7be3b-2937-45df-85ea-ca7133ea542c) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (36c7be3b-2937-45df-85ea-ca7133ea542c).

CVSS VectorVendor: 36c7be3b-2937-45df-85ea-ca7133ea542c

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 17:25 nvd

HIGH 8.2

DescriptionCVE.org

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

AnalysisAI

Spring Data Geode's snapshot import feature on Windows systems is vulnerable to path traversal attacks that enable attackers to write arbitrary files outside the intended extraction directory. Remote attackers can exploit this vulnerability without authentication to potentially overwrite critical system or application files. No patch is currently available.

Technical ContextAI

Affected ProductsAI

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.