CVE-2026-2741

Description

Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadins build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

Risk Information

Base Score

2.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L

EPSS Score

Exploitation Probability

0.061

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project 14.14.1	Windows
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project 23.6.7	Windows
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project 24.9.9	Windows
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project 25.0.3	Windows
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project for Linux 14.14.1	Linux
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project for Linux 23.6.7	Linux
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project for Linux 24.9.9	Linux
Vulnerabilities CVE-2026-2741 are fixed in Vaadin - flow-project for Linux 25.0.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234