Threats tagged 'ghsa-rr8v-fxxf-c986'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.3	EPSS 0.1%	CVE-2026-75598Gradle Shadow · Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization Medium6.3EPSS 0.1%2026-11-09GCVE DatabaseCVE-2026-75598 The Gradle Shadow plugin's ShadowCopyAction does not sanitize ZIP entry names before including them in the output fat JAR, allowing path traversal entries to be reproduced verbatim. This vulnerability affects versions prior to 9.6.0. Malicious dependencies with crafted ZIP entries can cause arbitrary file overwrite when the shadow JAR is extracted by downstream tools that do not protect against Zip Slip attacks. EPSS 0.1%Report on CVE-2026-75598 Vulnerability CWE-22 #ghsa-rr8v-fxxf-c986 #maven	GCVE Database	2026-11-09

Page 1 of 1