CVE-2026-2817 — Spring Data Geode Insecure Temporary Directory Usage

CVE-2026-2817

Spring Data Geode Insecure Temporary Directory Usage PUBLISHED

Description (CNA)

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.

Affected (CNA)

Vendor / product	Versions
VMware / Spring Data Geode	affected 2.0.0.RELEASE through 2.7.18
VMware / Spring Data Gemfire	affected 1.7.0.RELEASE through 2.2.13.RELEASE

CWE

CWE-538, CWE-378, CWE-379

References

https://www.herodevs.com/vulnerability-directory/cve-2026-2817

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.