Which versions of Java are affected by CVE-2026-40180?

Quarkus OpenAPI Generator versions before 2.16.0 and 2.15.0-lts contain a path traversal vulnerability allowing unauthenticated attackers to write arbitrary files to any location on the server during…. A patch is available.

Is there a public PoC exploit available for CVE-2026-40180?

Yes, a public proof-of-concept exploit is available for CVE-2026-40180. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-40180?

Within 24 hours: Identify all systems running Quarkus OpenAPI Generator and their current versions via dependency scanning tools (Maven, Gradle, or SBOMs). Within 7 days: Upgrade affected instances to Quarkus OpenAPI Generator 2.16.0 or 2.15.0-lts (LTS track) and perform regression testing on OpenAPI code generation pipelines. Within 30 days: Audit file system permissions on deployment targets to enforce principle of least privilege for application process accounts, and implement input validation controls for OpenAPI specification uploads.

Java CVE-2026-40180

Q: What is the CVSS score of CVE-2026-40180?

CVE-2026-40180 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21583 HIGH

Path Traversal (CWE-22)

2026-04-10 GitHub_M

Java Path Traversal

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21583

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:35 nvd

HIGH 7.7

DescriptionGitHub Advisory

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.

AnalysisAI

Path traversal vulnerability in Quarkus OpenAPI Generator (Quarkiverse) versions prior to 2.16.0 and 2.15.0-lts allows unauthenticated remote attackers to write arbitrary files outside intended directories via malicious ZIP archives. The ApicurioCodegenWrapper.java unzip() method fails to validate file paths during extraction, enabling path traversal sequences (../../) to bypass output directory restrictions and achieve arbitrary file write with high integrity impact. No public exploit identified at time of analysis. Affects Java-based Quarkus extensions for REST client and server stub generation.

Technical ContextAI

CWE-22 path traversal in ApicurioCodegenWrapper.java line 101: destination File constructed via new File(toOutputDir, entry.getName()) without canonicalization or path normalization checks before write operation. CVSS:4.0 vector PR:N confirms unauthenticated network exploitation, VI:H reflects arbitrary file write capability outside sandboxed extraction directory.

RemediationAI

Vendor-released patch: upgrade to version 2.16.0 (mainline) or 2.15.0-lts (long-term support branch). Upstream fixes available via commits 08b406414ff30ed192e86c7fa924e57565534ff0 and e2a9c629a3df719abc74569a3795c265fd0e1239 implement path validation in ZIP extraction logic. Organizations unable to upgrade immediately should disable or restrict access to OpenAPI code generation endpoints and validate all input ZIP archives through external security scanning. Consult vendor security advisory: https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q. No workarounds that maintain full functionality exist; patch deployment is strongly recommended.