Path Traversal Vulnerability in Gradle Shadow Plugin

CVE-2026-75598

What is CVE-2026-75598?

The Gradle Shadow plugin, used for creating fat or uber JARs, has a vulnerability that allows a malicious dependency to manipulate file paths within the generated ZIP archives. Prior to version 9.6.0, the plugin fails to validate ZIP entry names, which can lead to the preservation of traversal entry names. Consequently, if an archive containing erroneous entries is processed without appropriate path traversal protection, malicious files may be extracted to unintended locations, potentially compromising system security. This issue has been rectified in version 9.6.0, emphasizing the importance of upgrading to secure implementations.

References