CVE-2026-2741

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2741", "assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "state": "PUBLISHED", "assignerShortName": "Vaadin", "dateReserved": "2026-02-19T11:59:57.103Z", "datePublished": "2026-03-10T12:08:30.515Z", "dateUpdated": "2026-03-16T10:52:34.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "shortName": "Vaadin", "dateUpdated": "2026-03-16T10:52:34.173Z"}, "title": "Zip Slip Path Traversal on Node Unpack", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "vaadin", "product": "vaadin", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "com.vaadin:vaadin", "repo": "https://github.com/vaadin/platform", "versions": [{"status": "affected", "version": "14.2.0", "lessThanOrEqual": "14.14.0", "versionType": "maven"}, {"status": "affected", "version": "15.0.0", "lessThanOrEqual": "23.6.6", "versionType": "maven"}, {"status": "affected", "version": "24.0.0", "lessThanOrEqual": "24.9.8", "versionType": "maven"}, {"status": "affected", "version": "25.0.0", "lessThanOrEqual": "25.0.2", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "vaadin", "product": "flow", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "com.vaadin:flow-server", "repo": "https://github.com/vaadin/flow", "versions": [{"status": "affected", "version": "2.2.0", "lessThanOrEqual": "2.13.0", "versionType": "maven"}, {"status": "affected", "version": "3.0.0", "lessThanOrEqual": "23.6.7", "versionType": "maven"}, {"status": "affected", "version": "24.0.0", "lessThanOrEqual": "24.9.9", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "vaadin", "product": "flow", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "com.vaadin:flow-build-tools", "repo": "https://github.com/vaadin/flow", "versions": [{"status": "affected", "version": "25.0.0", "lessThanOrEqual": "25.0.3", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. \n\nVaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.\n\n\nUsers of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span><p>Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. <br><br>Vaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.</p>\n<p>Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.<br><br>Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.<br></p><br></span>"}]}], "references": [{"url": "https://vaadin.com/security/cve-2026-2741"}, {"url": "https://github.com/vaadin/flow/pull/23125"}, {"url": "https://github.com/vaadin/flow/pull/23131"}, {"url": "https://github.com/vaadin/flow/pull/23135"}, {"url": "https://github.com/vaadin/flow/pull/23133"}, {"url": "https://github.com/vaadin/flow/pull/23130"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber"}}], "workarounds": [{"lang": "en", "value": "Use a globally preinstalled Node.js that is compatible with the Vaadin version instead of relying on Vaadin's automatic Node.js download.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<b><span style=\"background-color: transparent;\">Use a globally preinstalled Node.js that is compatible with the Vaadin version instead of relying on Vaadin's automatic Node.js download.</span></b><br>"}]}], "solutions": [{"lang": "en", "value": "Users of affected versions should apply the following mitigation or upgrade.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<b><span style=\"background-color: transparent;\">Users of affected versions should apply the following mitigation or upgrade.</span></b><br>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T13:45:35.148213Z", "id": "CVE-2026-2741", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T13:45:42.474Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2741", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T13:45:35.148213Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T13:45:38.416Z"}}], "cna": {"title": "Zip Slip Path Traversal on Node Unpack", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 2.3, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/vaadin/platform", "vendor": "vaadin", "product": "vaadin", "versions": [{"status": "affected", "version": "14.2.0", "versionType": "maven", "lessThanOrEqual": "14.14.0"}, {"status": "affected", "version": "15.0.0", "versionType": "maven", "lessThanOrEqual": "23.6.6"}, {"status": "affected", "version": "24.0.0", "versionType": "maven", "lessThanOrEqual": "24.9.8"}, {"status": "affected", "version": "25.0.0", "versionType": "maven", "lessThanOrEqual": "25.0.2"}], "packageName": "com.vaadin:vaadin", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"repo": "https://github.com/vaadin/flow", "vendor": "vaadin", "product": "flow", "versions": [{"status": "affected", "version": "2.2.0", "versionType": "maven", "lessThanOrEqual": "2.13.0"}, {"status": "affected", "version": "3.0.0", "versionType": "maven", "lessThanOrEqual": "23.6.7"}, {"status": "affected", "version": "24.0.0", "versionType": "maven", "lessThanOrEqual": "24.9.9"}], "packageName": "com.vaadin:flow-server", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"repo": "https://github.com/vaadin/flow", "vendor": "vaadin", "product": "flow", "versions": [{"status": "affected", "version": "25.0.0", "versionType": "maven", "lessThanOrEqual": "25.0.3"}], "packageName": "com.vaadin:flow-build-tools", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users of affected versions should apply the following mitigation or upgrade.", "supportingMedia": [{"type": "text/html", "value": "<b><span style=\"background-color: transparent;\">Users of affected versions should apply the following mitigation or upgrade.</span></b><br>", "base64": false}]}], "references": [{"url": "https://vaadin.com/security/cve-2026-2741"}, {"url": "https://github.com/vaadin/flow/pull/23125"}, {"url": "https://github.com/vaadin/flow/pull/23131"}, {"url": "https://github.com/vaadin/flow/pull/23135"}, {"url": "https://github.com/vaadin/flow/pull/23133"}, {"url": "https://github.com/vaadin/flow/pull/23130"}], "workarounds": [{"lang": "en", "value": "Use a globally preinstalled Node.js that is compatible with the Vaadin version instead of relying on Vaadin's automatic Node.js download.", "supportingMedia": [{"type": "text/html", "value": "<b><span style=\"background-color: transparent;\">Use a globally preinstalled Node.js that is compatible with the Vaadin version instead of relying on Vaadin's automatic Node.js download.</span></b><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. \n\nVaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.\n\n\nUsers of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.", "supportingMedia": [{"type": "text/html", "value": "<span><p>Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. <br><br>Vaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.</p>\n<p>Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.<br><br>Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.<br></p><br></span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "shortName": "Vaadin", "dateUpdated": "2026-03-16T10:52:34.173Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2741", "state": "PUBLISHED", "dateUpdated": "2026-03-16T10:52:34.173Z", "dateReserved": "2026-02-19T11:59:57.103Z", "assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "datePublished": "2026-03-10T12:08:30.515Z", "assignerShortName": "Vaadin"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "com.vaadin:vaadin", "product": "vaadin", "repo": "https://github.com/vaadin/platform", "vendor": "vaadin", "versions": [{"lessThanOrEqual": "14.14.0", "status": "affected", "version": "14.2.0", "versionType": "maven"}, {"lessThanOrEqual": "23.6.6", "status": "affected", "version": "15.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.9.8", "status": "affected", "version": "24.0.0", "versionType": "maven"}, {"lessThanOrEqual": "25.0.2", "status": "affected", "version": "25.0.0", "versionType": "maven"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "com.vaadin:flow-server", "product": "flow", "repo": "https://github.com/vaadin/flow", "vendor": "vaadin", "versions": [{"lessThanOrEqual": "2.13.0", "status": "affected", "version": "2.2.0", "versionType": "maven"}, {"lessThanOrEqual": "23.6.7", "status": "affected", "version": "3.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.9.9", "status": "affected", "version": "24.0.0", "versionType": "maven"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "com.vaadin:flow-build-tools", "product": "flow", "repo": "https://github.com/vaadin/flow", "vendor": "vaadin", "versions": [{"lessThanOrEqual": "25.0.3", "status": "affected", "version": "25.0.0", "versionType": "maven"}]}], "source": "security@vaadin.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "026380A5-2BBC-47CA-9D7D-30F2E5D03DDE", "versionEndExcluding": "14.14.1", "versionStartIncluding": "14.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "619712A7-0E1B-40FC-984C-BB6445692C9F", "versionEndExcluding": "23.6.7", "versionStartIncluding": "15.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2955496-137C-489B-B39C-FB54A0994263", "versionEndExcluding": "24.9.10", "versionStartIncluding": "24.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "02E376FA-0B49-4B6C-9DE3-58F44F511CD8", "versionEndExcluding": "25.0.4", "versionStartIncluding": "25.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. \n\nVaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.\n\n\nUsers of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version."}, {"lang": "es", "value": "Archivos ZIP especialmente dise\u00f1ados pueden escapar del directorio de extracci\u00f3n previsto durante la descarga y extracci\u00f3n de Node.js en Vaadin 14.2.0 hasta 14.14.0, 23.0.0 hasta 23.6.6, 24.0.0 hasta 24.9.8, y 25.0.0 hasta 25.0.2.\n\nEl proceso de compilaci\u00f3n de Vaadin puede descargar y extraer Node.js autom\u00e1ticamente si no est\u00e1 instalado localmente. Si un atacante puede interceptar o controlar esta descarga a trav\u00e9s de secuestro de DNS, un ataque MitM, un espejo comprometido o un ataque a la cadena de suministro, pueden servir un archivo malicioso que contiene secuencias de salto de ruta que escriben archivos fuera del directorio de extracci\u00f3n previsto.\n\nLos usuarios de las versiones afectadas deben usar una versi\u00f3n de Node.js preinstalada globalmente compatible con su versi\u00f3n de Vaadin, o actualizar de la siguiente manera: 14.2.0-14.14.0 a 14.14.1, 23.0.0-23.6.6 a 23.6.7, 24.0.0-24.9.8 a 24.9.9, y 25.0.0-25.0.2 a 25.0.3 o m\u00e1s reciente.\n\nTenga en cuenta que las versiones de Vaadin 10-13 y 15-22 ya no son compatibles y debe actualizar a la \u00faltima versi\u00f3n 14, 23, 24 o 25."}], "id": "CVE-2026-2741", "lastModified": "2026-06-17T10:31:38.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "security@vaadin.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2741", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T13:45:35.148213Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:48.953", "references": [{"source": "security@vaadin.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vaadin/flow/pull/23125"}, {"source": "security@vaadin.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vaadin/flow/pull/23130"}, {"source": "security@vaadin.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vaadin/flow/pull/23131"}, {"source": "security@vaadin.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vaadin/flow/pull/23133"}, {"source": "security@vaadin.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vaadin/flow/pull/23135"}, {"source": "security@vaadin.com", "tags": ["Vendor Advisory"], "url": "https://vaadin.com/security/cve-2026-2741"}], "sourceIdentifier": "security@vaadin.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@vaadin.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Vaadin-Flow: Vaadin: Arbitrary file write via path traversal during Node.js download", "id": "2446008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446008"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. \nVaadin\u2019s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.\nUsers of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.", "A flaw was found in Vaadin. During the automatic download and extraction of Node.js, a remote attacker could exploit a path traversal vulnerability. By intercepting or controlling the Node.js download, an attacker could serve a specially crafted ZIP archive. This malicious archive would allow files to be written outside the intended directory, potentially leading to unauthorized file creation or modification on the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure a compatible Node.js version is preinstalled globally on systems using Vaadin. This prevents Vaadin's build process from automatically downloading and extracting Node.js, thereby eliminating the vulnerable path. Verify that the preinstalled Node.js version meets the requirements of your Vaadin application."}, "name": "CVE-2026-2741", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "flow-push", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "flow-server", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "flow-push", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "flow-server", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-03-10T12:08:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-2741\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2741\nhttps://github.com/vaadin/flow/pull/23125\nhttps://vaadin.com/security/cve-2026-2741"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.2.0,14.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,23.6.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.0.0,24.9.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "flow", "source": "cna", "vendor": "vaadin"}, "product": "flow", "vendor": "vaadin"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,25.0.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "flow", "source": "cna", "vendor": "vaadin"}, "product": "flow", "vendor": "vaadin"}], "analysis": {"en": {"generated_at": "2026-04-16T03:54:18.176914+00:00", "value": {"mitigation_remediation": ["Upgrade Vaadin Flow to a fixed release\u2014upgrade from 14.2.0\u201114.14.0 to 14.14.1, from 15.0.0\u201123.6.6 to 23.6.7, from 24.0.0\u201124.9.8 to 24.9.9, or from 25.0.0\u201125.0.2 to 25.0.3 or newer.", "If an upgrade is not immediately possible, install a globally preinstalled Node.js version that is compatible with your Vaadin Flow release and configure the build to use that local Node.js binary, thereby preventing Vaadin from auto\u2011downloading and extracting the ZIP archive.", "Secure the network and package delivery channels by enforcing DNSSEC, validating TLS certificates, and ensuring that any mirrors or caches used to fetch Node.js archives are authenticated and originate from trusted sources."], "summary": {"action": "Apply Patch", "impact": "Path Traversal \u2013 potential arbitrary file write during automatic Node.js download"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Vaadin Flow for versions 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin versions 10\u201113 and 15\u201122 are no longer supported, and users should consider updating to the latest supported releases of 14, 23, 24, or 25.", "description_and_impact": "A specially crafted ZIP archive can escape the intended extraction directory when Vaadin automatically downloads and unpacks Node.js. If an attacker can supply the archive\u2014for example, via DNS hijacking, a MITM attack, a compromised mirror, or a supply\u2011chain compromise\u2014they can write files outside the expected directory, potentially overwriting build artifacts or inserting malicious code. This allows arbitrary file creation or modification inside the Vaadin project workspace, which could compromise confidentiality, integrity, or execution of the build.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1\u202f% shows a very small probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to control the Node.js archive download, which can happen through DNS hijacking, a MITM attack, a compromised mirror, or a supply\u2011chain compromise. When such an attack vector exists, the path\u2011traversal could enable writing arbitrary files during the build process, potentially leading to code injection or privilege escalation within the build environment."}}}}, "created": "2026-03-11T11:50:16.884725+00:00", "updated": "2026-04-16T04:00:09.451573+00:00", "vendors": ["vaadin", "vaadin$PRODUCT$flow"]}