Zip Slip Path Traversal on Node Unpack
Summary
| CVE | CVE-2026-2741 |
|---|---|
| State | PUBLISHED |
| Assigner | Vaadin |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-03-10 18:18:48 UTC |
| Updated | 2026-05-07 18:44:38 UTC |
| Description | Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. |
Risk And Classification
Primary CVSS: v4.0 2.3 LOW from [email protected]
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Amber
Problem Types: CWE-22 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 2.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/A... |
| 3.1 | [email protected] | Primary | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighAttack Requirements
PresentPrivileges Required
LowUser Interaction
NoneConfidentiality
LowIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Amber
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Vaadin | Vaadin | affected 14.2.0 14.14.0 maven | Not specified |
| CNA | Vaadin | Vaadin | affected 15.0.0 23.6.6 maven | Not specified |
| CNA | Vaadin | Vaadin | affected 24.0.0 24.9.8 maven | Not specified |
| CNA | Vaadin | Vaadin | affected 25.0.0 25.0.2 maven | Not specified |
| CNA | Vaadin | Flow | affected 2.2.0 2.13.0 maven | Not specified |
| CNA | Vaadin | Flow | affected 3.0.0 23.6.7 maven | Not specified |
| CNA | Vaadin | Flow | affected 24.0.0 24.9.9 maven | Not specified |
| CNA | Vaadin | Flow | affected 25.0.0 25.0.3 maven | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/vaadin/flow/pull/23133 | [email protected] | github.com | Issue Tracking, Patch |
| github.com/vaadin/flow/pull/23131 | [email protected] | github.com | Issue Tracking, Patch |
| github.com/vaadin/flow/pull/23125 | [email protected] | github.com | Issue Tracking, Patch |
| github.com/vaadin/flow/pull/23130 | [email protected] | github.com | Issue Tracking, Patch |
| vaadin.com/security/cve-2026-2741 | [email protected] | vaadin.com | Vendor Advisory |
| github.com/vaadin/flow/pull/23135 | [email protected] | github.com | Issue Tracking, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Users of affected versions should apply the following mitigation or upgrade.
Workarounds
CNA: Use a globally preinstalled Node.js that is compatible with the Vaadin version instead of relying on Vaadin's automatic Node.js download.
There are currently no legacy QID mappings associated with this CVE.