Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40180 Path Traversal in Quarkus OpenAPI Generator Prior to 2.16.0 and 2.15.0-LTS https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40180
Post summary
CVE‑2026‑40180 discloses a path‑traversal flaw in Quarkus OpenAPI Generator affecting versions earlier than 2.16.0 and 2.15.0‑LTS.
CVE-2026-40180 Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in Api… https://www.cve.org/CVERecord?id=CVE-2026-40180
Post summary
The brief post cites CVE‑2026‑40180 affecting Quarkus OpenAPI Generator’s unzip method but offers no further details, proofs, or mitigation information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | quarkiverse | quarkus_openapi_generator | - | - | - |
| App | quarkiverse | quarkus_openapi_generator | 2.15.0 | - | - |