Which versions of Java are affected by CVE-2026-4741?

CVE-2026-4741 presents significant security risk, a path traversal vulnerability rated CVSS 8.6.. A patch is available.

How to fix or mitigate CVE-2026-4741?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Java CVE-2026-4741

Q: What is the CVSS score of CVE-2026-4741?

CVE-2026-4741 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-14703 HIGH

Path Traversal (CWE-22)

2026-03-24 GovTech CSG

GHSA-f24v-4cgw-g3g9

Java Path Traversal

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 03:30 euvd

EUVD-2026-14703

Analysis Generated

Mar 24, 2026 - 03:30 vuln.today

Patch released

Mar 24, 2026 - 03:30 nvd

Patch available

CVE Published

Mar 24, 2026 - 03:22 nvd

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid (app/src/main/java/com/rdapps/gamepad/util modules). This vulnerability is associated with program files UnzipUtil.Java‎.

This issue affects JoyConDroid: through 1.0.93.

AnalysisAI

Path traversal in JoyConDroid through version 1.0.93 allows unauthenticated remote attackers to access arbitrary files on affected systems through improper pathname validation in the UnzipUtil module. An attacker can exploit this vulnerability to read sensitive data and potentially modify files, achieving high integrity and availability impact. A patch is available for this high-severity vulnerability affecting Java and Joycondroid users.

Technical ContextAI

The vulnerability resides in the UnzipUtil.Java file within the com.rdapps.gamepad.util module of JoyConDroid, a Java-based gamepad controller application. The root cause is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), which occurs when archive extraction logic fails to properly validate or sanitize file paths extracted from ZIP archives. Attackers can exploit this by crafting malicious ZIP files containing path traversal sequences (such as '../' or absolute paths) that, when extracted by the vulnerable UnzipUtil component, write files to arbitrary locations on the device's filesystem outside the intended extraction directory. This is a common vulnerability pattern in Java archive handling utilities when path normalization is insufficient.

RemediationAI

Upgrade JoyConDroid to a version that includes the fix from GitHub pull request #124 (https://github.com/TeamJCD/JoyConDroid/pull/124) or later; check the official TeamJCD repository for the next official release incorporating this patch. Until an updated release is available, avoid processing untrusted or user-supplied ZIP archives within the application. Developers integrating JoyConDroid or maintaining custom builds should immediately apply the patch from pull request #124 to the UnzipUtil.Java module to validate and sanitize extracted file paths, ensuring they remain within the intended extraction directory using proper path normalization techniques (e.g., java.nio.file.Path.normalize() or similar canonical path validation). If source code modifications are necessary before an official patch release, implement whitelist-based path validation or use Java's ZipInputStream with explicit path checks to prevent directory traversal.