Vaadin: Speziell erstellte ZIP-Archive können das beabsichtigte Extraktionsverzeichnis verlassen

This vulnerability arises from the way Vaadin’s build process handles Node.js downloads. If an attacker can intercept or control the download process—through techniques like DNS hijacking, a man-in-the-middle (MITM) attack, a compromised mirror, or a supply chain attack—they can serve a malicious ZIP archive. This archive would contain path traversal sequences designed to write files to arbitrary locations on the system. The potential impact includes overwriting critical system files, injecting malicious code, or gaining unauthorized access to sensitive data. While the CVSS score is LOW, the potential for supply chain compromise elevates the risk, as attackers could target the download infrastructure to affect numerous downstream users.

Organizations using Vaadin Flow Project in their web applications, particularly those relying on automated Node.js downloads during the build process, are at risk. Shared hosting environments where users have limited control over the build process are also particularly vulnerable.

• java / server:

find /path/to/vaadin/installation -name "flow-project*" -type d -print0 | xargs -0 grep -i 'path traversal'

• generic web:

curl -I <your_vaadin_application_url> | grep -i 'X-Content-Type-Options: nosniff'

1. 2026-03-10Disclosure

   disclosure

1. Reserviert2026-02-19
2. Veröffentlicht2026-03-10
3. Geändert2026-03-14
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to version 14.14.1 or later of the Vaadin Flow Project. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Verify the integrity of Node.js downloads by using checksum verification or digital signatures. Implement strict network segmentation to limit the potential impact of a compromised download. Consider using a Web Application Firewall (WAF) to filter out malicious ZIP archives containing path traversal sequences. Monitor system logs for unusual file creation or modification activity, particularly in unexpected directories.