Vaadin: विशेष रूप से तैयार किए गए ZIP अभिलेखागार इच्छित निष्कर्षण निर्देशिका से बाहर निकल सकते हैं

An attacker can exploit this vulnerability by intercepting the Node.js download process during Vaadin’s build. This could be achieved through various methods, including DNS hijacking, man-in-the-middle (MITM) attacks, compromised mirrors, or supply chain attacks. By serving a malicious ZIP archive containing path traversal sequences, the attacker can write arbitrary files to the server's file system outside the intended extraction directory. This could lead to code execution, data exfiltration, or denial of service, depending on the permissions of the process performing the extraction. The potential blast radius extends to any sensitive data accessible by the Vaadin application and the underlying server.

Organizations using Vaadin Flow Project in their web applications, particularly those relying on automated Node.js downloads during the build process, are at risk. Shared hosting environments where users have limited control over the build process are also particularly vulnerable.

• java / server:

find /path/to/vaadin/installation -name "flow-project*" -type d -print0 | xargs -0 grep -i 'path traversal'

• generic web:

curl -I <your_vaadin_application_url> | grep -i 'X-Content-Type-Options: nosniff'

1. 2026-03-10Disclosure

   disclosure

1. आरक्षित2026-02-19
2. प्रकाशित2026-03-10
3. संशोधित2026-03-14
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-2741 is to upgrade to version 14.14.1 or later of the Vaadin Flow Project. If upgrading immediately is not feasible, consider implementing temporary workarounds. Verify the integrity of Node.js downloads by using checksum verification or digital signatures. Implement strict file system permissions to limit the impact of potential file writes. Consider using a Web Application Firewall (WAF) to filter out malicious ZIP archives containing path traversal sequences. Regularly scan your environment for vulnerable versions of Vaadin Flow Project.