CVE-2026-2741

Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

• CWE-22

• https://github.com/vaadin/flow/pull/23125Issue Tracking, Patch
• https://github.com/vaadin/flow/pull/23130Issue Tracking, Patch
• https://github.com/vaadin/flow/pull/23131Issue Tracking, Patch
• https://github.com/vaadin/flow/pull/23133Issue Tracking, Patch
• https://github.com/vaadin/flow/pull/23135Issue Tracking, Patch
• https://vaadin.com/security/cve-2026-2741Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27404Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 ver…7.1
• CVE-2026-27405Missing Authorization vulnerability in Magepeople inc. WpBoo…6.5
• CVE-2026-27406Insertion of Sensitive Information Into Sent Data vulnerabil…7.5
• CVE-2026-27407Editor Privilege Escalation in AI Engine <= 3.4.9 versions.7.2
• CVE-2026-27408Unauthenticated Cross Site Scripting (XSS) in NativeChurch <…7.1
• CVE-2026-27409Missing Authorization vulnerability in Webba Plugins Webba B…5.3
• CVE-2026-27410Unauthenticated Deserialization of untrusted data in Slimsta…6.5
• CVE-2026-27411Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Pl…5.4
• CVE-2026-27412Unauthenticated Local File Inclusion in Pearl - Corporate Bu…8.1
• CVE-2026-27413Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-27414Contributor PHP Object Injection in Werkstatt <= 4.8.3 versi…8.8
• CVE-2026-27415Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.…4.3