# CVE-2026-75598: Gradle Shadow plugin Zip Slip path traversal

Source: https://junglewise.ai/threats/cve-2026-75598-the-gradle-shadow-plugin-creates-fat-or-uber-jars-and-supports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-75598 · Severity: high · CVSS 8.1 · Published 2026-11-06

Gradle Shadow is a plugin that packages Java applications and their dependencies into a single JAR file. Versions prior to 9.6.0 fail to validate file paths within the packaged archive, allowing a malicious dependency to include specially crafted entries that can extract files outside the intended directory. If extracted without protections, an attacker could write files to arbitrary locations on a system.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-75598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75598 being exploited in the wild.

**How severe is CVE-2026-75598?** High severity, with a CVSS score of 8.1, published 6 November 2026.

**Which products and versions are affected?** Gradle Shadow prior to 9.6.0; com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (Maven) < 9.6.0, ECOSYSTEM:introduced=0,fixed=9.6.0.

**Is there a fix for CVE-2026-75598?** Yes. com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (Maven): upgrade to 9.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75598 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75598?** Check whether you run Gradle Shadow or com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (Maven): upgrade to 9.6.0 or later

  ```sh
  # set com.gradleup.shadow:com.gradleup.shadow.gradle.plugin to 9.6.0 in your pom.xml or build.gradle
  ```


## Technical details

The Shadow plugin does not independently validate ZIP entry names before writing them to output archives, allowing Zip Slip path traversal attacks. A malicious dependency can preserve traversal entry names (e.g., "../../../etc/passwd") in the generated JAR. When the resulting archive is extracted by downstream tooling or end users without path traversal protection, attacker-controlled files can be written outside the intended extraction directory.

## Affected products

- Gradle Shadow prior to 9.6.0

## Identifiers

- CVE-2026-75598
- GHSA-rr8v-fxxf-c986

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd](https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd)
- [https://github.com/GradleUp/shadow/releases/tag/9.6.0](https://github.com/GradleUp/shadow/releases/tag/9.6.0)