Executive brief
A security vulnerability exists in Spring Data Geode, a library used for integrating Spring applications with the Apache Geode data management platform. When running on Windows, the library fails to properly check file names within imported archive files, allowing a malicious file to be written to unintended locations on the server. This could allow an attacker to corrupt data, gain persistent access to the system, or potentially execute unauthorized code.
Technical details
A Zip-Slip path traversal vulnerability (CWE-22/CWE-23) exists in the snapshot import functionality of Spring Data Geode and Spring Data GemFire. The root cause is a failure in filename sanitization logic that relies on the platform's native path separator; on Windows, the library fails to recognize forward slashes (/) used in ZIP entries as directory separators, allowing '../' sequences to bypass checks. An attacker can exploit this by providing a specially crafted ZIP or JAR archive, leading to arbitrary file writes in any directory where the application has permissions. This vulnerability specifically affects Windows-based deployments. Community support for these products has ended, though commercial patches are available via HeroDevs.
Affected products
- VMware Spring Data Geode >= 2.0.0, <= 2.7.18
- VMware Spring Data GemFire >= 1.7.0, <= 2.2.13.RELEASE
- Red Hat Red Hat Fuse 7 unaffected
Timeline
- 2026-02-19: patched: Fixed in HeroDevs Never-Ending Support (NES) version
- 2026-02-20: disclosed: Initial disclosure and NVD publication