CVE-2026-2741: Path Traversal in Vaadin Flow Project

An attacker can exploit this vulnerability by intercepting the Node.js download process during Vaadin’s build. This could be achieved through various methods, including DNS hijacking, man-in-the-middle (MITM) attacks, compromised mirrors, or supply chain attacks. By serving a malicious ZIP archive containing path traversal sequences, the attacker can write arbitrary files to the server's file system outside the intended extraction directory. This could lead to code execution, data exfiltration, or denial of service, depending on the permissions of the process performing the extraction. The potential blast radius extends to any sensitive data accessible by the Vaadin application and the underlying server.

1. Reserved2026-02-19
2. Published2026-03-10
3. Modified2026-03-14
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-2741 is to upgrade to version 14.14.1 or later of the Vaadin Flow Project. If upgrading immediately is not feasible, consider implementing temporary workarounds. Verify the integrity of Node.js downloads by using checksum verification or digital signatures. Implement strict file system permissions to limit the impact of potential file writes. Consider using a Web Application Firewall (WAF) to filter out malicious ZIP archives containing path traversal sequences. Regularly scan your environment for vulnerable versions of Vaadin Flow Project.