CVE-2026-2741
Analyzed Analyzed - Analysis Complete
Path Traversal in Vaadin Node.js Extraction Enables File Write Escape

Publication date: 2026-03-10

Last updated on: 2026-05-07

Assigner: Vaadin Ltd.

Description
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-05-07
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-2741
EUVD
EUVD-2026-10496
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
vaadin vaadin From 15.0.0 (inc) to 23.6.7 (exc)
vaadin vaadin From 14.2.0 (inc) to 14.14.1 (exc)
vaadin vaadin From 24.0.0 (inc) to 24.9.10 (exc)
vaadin vaadin From 25.0.0 (inc) to 25.0.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-2741 is a Zip Slip path traversal vulnerability affecting Vaadin's automatic Node.js download and extraction process in certain versions. Specially crafted ZIP archives can escape the intended extraction directory during Node.js unpacking, allowing an attacker to write files outside the target directory."}, {'type': 'paragraph', 'content': 'This vulnerability occurs if an attacker can intercept or control the Node.js download process via DNS hijacking, man-in-the-middle attacks, compromised mirrors, or supply chain attacks, serving malicious archives containing path traversal sequences.'}, {'type': 'paragraph', 'content': 'The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and affects Vaadin versions 14.2.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2.'}] [5]

Impact Analysis

[{'type': 'paragraph', 'content': 'If exploited, this vulnerability allows an attacker to write files outside the intended extraction directory during the Node.js download and extraction process in Vaadin. This could lead to unauthorized file creation or modification anywhere the application has write permissions.'}, {'type': 'paragraph', 'content': "Such unauthorized file writes could be used to execute malicious code, alter application behavior, or compromise the system's integrity, especially if the attacker controls the download source through DNS hijacking, man-in-the-middle attacks, or supply chain compromises."}] [5]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': 'To mitigate the CVE-2026-2741 vulnerability, users should upgrade affected Vaadin versions to the fixed releases as follows:'}, {'type': 'list_item', 'content': 'Upgrade Vaadin 14.2.0 through 14.14.0 to version 14.14.1 or later.'}, {'type': 'list_item', 'content': 'Upgrade Vaadin 23.0.0 through 23.6.6 to version 23.6.7 or later.'}, {'type': 'list_item', 'content': 'Upgrade Vaadin 24.0.0 through 24.9.8 to version 24.9.9 or later.'}, {'type': 'list_item', 'content': 'Upgrade Vaadin 25.0.0 through 25.0.2 to version 25.0.3 or later.'}, {'type': 'paragraph', 'content': "Alternatively, users can avoid Vaadin's automatic Node.js download and extraction by using a globally preinstalled Node.js version compatible with their Vaadin version."}, {'type': 'paragraph', 'content': 'Note that Vaadin versions 10-13 and 15-22 are no longer supported, so upgrading to the latest supported major versions (14, 23, 24, or 25) is recommended.'}] [5]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart