CVE-2026-2741 — MEDIUM (6.8)

Q: How severe is CVE-2026-2741?

CVE-2026-2741 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-2741?

Check the references section above for vendor advisories and patch information. Affected products include: Vaadin Vaadin.

Vulnerability Description

Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Vaadin	Vaadin	>= 14.2.0, < 14.14.1

Related Weaknesses (CWE)

CWE-22

References

https://github.com/vaadin/flow/pull/23125Issue TrackingPatch
https://github.com/vaadin/flow/pull/23130Issue TrackingPatch
https://github.com/vaadin/flow/pull/23131Issue TrackingPatch
https://github.com/vaadin/flow/pull/23133Issue TrackingPatch
https://github.com/vaadin/flow/pull/23135Issue TrackingPatch
https://vaadin.com/security/cve-2026-2741Vendor Advisory

FAQ

What is CVE-2026-2741?

CVE-2026-2741 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 2...

How severe is CVE-2026-2741?

CVE-2026-2741 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-2741?

Check the references section above for vendor advisories and patch information. Affected products include: Vaadin Vaadin.