Is CVE-2026-2818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2818 being exploited in the wild.

How severe is CVE-2026-2818?

High severity, with a CVSS score of 8.2, published 20 February 2026.

Which products and versions are affected?

Red Hat Fuse 7 unaffected; VMware Spring Data GemFire >= 1.7.0, = 2.0.0, <= 2.7.18.

Is there a fix for CVE-2026-2818?

A patch was published on 2026-02-19: Fixed in HeroDevs Never-Ending Support (NES) version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2818 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-2818?

Check whether you run Red Hat Fuse 7, VMware Spring Data GemFire or VMware Spring Data Geode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2818: VMware Spring Data Geode Path Traversal in Snapshot Import

Q: Is there a fix for CVE-2026-2818?

A patch was published on 2026-02-19: Fixed in HeroDevs Never-Ending Support (NES) version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-2818 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-2818?

Check whether you run Red Hat Fuse 7, VMware Spring Data GemFire or VMware Spring Data Geode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2818 · Severity: high · CVSS 8.2 · Published 2026-02-20

A security vulnerability exists in Spring Data Geode, a library used for integrating Spring applications with the Apache Geode data management platform. When running on Windows, the library fails to properly check file names within imported archive files, allowing a malicious file to be written to unintended locations on the server. This could allow an attacker to corrupt data, gain persistent access to the system, or potentially execute unauthorized code.

Technologies: Red Hat Fuse 7. Vendors: Red Hat, VMware.

Quick answers

Is CVE-2026-2818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2818 being exploited in the wild.
How severe is CVE-2026-2818?: High severity, with a CVSS score of 8.2, published 20 February 2026.
Which products and versions are affected?: Red Hat Fuse 7 unaffected; VMware Spring Data GemFire >= 1.7.0, <= 2.2.13.RELEASE; VMware Spring Data Geode >= 2.0.0, <= 2.7.18.
Is there a fix for CVE-2026-2818?: A patch was published on 2026-02-19: Fixed in HeroDevs Never-Ending Support (NES) version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2818 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-2818?: Check whether you run Red Hat Fuse 7, VMware Spring Data GemFire or VMware Spring Data Geode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Zip-Slip path traversal vulnerability (CWE-22/CWE-23) exists in the snapshot import functionality of Spring Data Geode and Spring Data GemFire. The root cause is a failure in filename sanitization logic that relies on the platform's native path separator; on Windows, the library fails to recognize forward slashes (/) used in ZIP entries as directory separators, allowing '../' sequences to bypass checks. An attacker can exploit this by providing a specially crafted ZIP or JAR archive, leading to arbitrary file writes in any directory where the application has permissions. This vulnerability specifically affects Windows-based deployments. Community support for these products has ended, though commercial patches are available via HeroDevs.

Affected products

VMware Spring Data Geode >= 2.0.0, <= 2.7.18
VMware Spring Data GemFire >= 1.7.0, <= 2.2.13.RELEASE
Red Hat Red Hat Fuse 7 unaffected

Timeline

2026-02-19: patched: Fixed in HeroDevs Never-Ending Support (NES) version
2026-02-20: disclosed: Initial disclosure and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.