Executive brief
The Quarkus OpenAPI Generator, a tool used to automatically create web service code from API definitions, is vulnerable to a 'Zip Slip' attack. An attacker who can provide a malicious ZIP file to the tool during the software build process can write files to unauthorized locations on the developer's machine or build server. This could lead to the injection of malicious code into software projects or the compromise of the automated build pipeline.
Technical details
A path traversal vulnerability (Zip Slip) exists in the unzip() method of ApicurioCodegenWrapper.java within the Quarkus OpenAPI Generator. The component fails to validate that ZIP entry paths, such as those containing '../' sequences, remain within the intended output directory before writing them to disk. An attacker capable of serving a crafted ZIP archive from a compromised or intercepted Apicurio registry endpoint can achieve arbitrary file writes on the build system. This can result in source code overwriting or malicious code injection during the build/codegen phase. The issue is resolved in versions 2.16.0 and 2.15.0-lts by implementing path normalization and validation.
Affected products
- Quarkiverse Quarkus OpenAPI Generator < 2.16.0, < 2.15.0-lts
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-10: disclosed: CVE-2026-40180 published
References
- https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0
- https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239
- https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q