CVE-2026-40180 Details
Description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
A path traversal vulnerability has been identified in the Quarkus OpenAPI Generator extension, specifically in versions prior to 2.16.0 and 2.15.0-lts. The issue arises in the 'unzip()' method of the 'ApicurioCodegenWrapper' class, where ZIP entries are extracted without proper validation of the file paths. This oversight allows a malicious ZIP file containing path traversal sequences to write files outside the intended output directory. The vulnerability could be exploited by intercepting or controlling the ZIP archive served by the Apicurio registry, particularly in environments with untrusted network connections or improperly configured TLS.
Users can upgrade to Quarkus OpenAPI Generator versions 2.16.0 or 2.15.0-lts to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| quarkiverse quarkus openapi generator | < 2.15.0 2.15.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |