Path Traversal Vulnerability in Quarkus OpenAPI Generator by Quarkus

CVE-2026-40180

What is CVE-2026-40180?

The Quarkus OpenAPI Generator contains a vulnerability in its unzip() method, which allows for path traversal through malicious ZIP entries. Prior to versions 2.16.0 and 2.15.0-lts, the method improperly handles file extraction, enabling attackers to exploit this weakness by crafting ZIP files that include path traversal sequences, such as ../../. This flaw permits unauthorized writing of files outside the designated output directory, exposing systems to potential data breaches and integrity issues. Users are encouraged to upgrade to the patched versions to mitigate risks associated with this vulnerability.

References