CVE-2026-2817
Medium · 4.4CVSS
4.4
EPSS
0.2%
Published
Feb 19, 2026
CISA due date
—
The record
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-46388 osquery is a SQL powered operating system instrumentation, monitoring, and analytics… CWE-378
- CVE-2026-4137 In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in… CWE-378
- GHSA-9q8j-chc7-wpgp Duplicate Advisory: OpenClaw session transcript files were created without forced… CWE-378
- CVE-2026-33572 OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad… CWE-378
- CVE-2026-4822 A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. CWE-378
- CVE-2025-46685 Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of… CWE-378
- CVE-2025-46684 Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of… CWE-378
- CVE-2025-34352 JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that… CWE-378