CVE-2026-40180 Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class
Attackers can write files outside the target directory via malicious ZIP archives, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40180?
CVE-2026-40180 is a high-severity path traversal vulnerability in quarkiverse quarkus-openapi-generator, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
Weakness: CWE-22
Which versions are affected by CVE-2026-40180?
2 open source packages ship an affected version, including io.quarkiverse.openapi.generator:quarkus-openapi-generator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | All versions | 2.16.0 |
io.quarkiverse.openapi.generator:quarkus-openapi-generator Maven | All versions | 2.16.0 |
Products include Quarkiverse Quarkus Openapi Generator.
How do I fix CVE-2026-40180?
Upgrade io.quarkiverse.openapi.generator:quarkus-openapi-generator to 2.16.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40180 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40180 exists.
Sources
Also known as GHSA-jx2w-vp7f-456q.