CVE-2026-40180

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.

• CWE-22

• https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0Patch
• https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239Patch
• https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456qExploit, Vendor Advisory
• https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456qExploit, Vendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40175Axios is a promise based HTTP client for the browser and Nod…4.8
• CVE-2026-40176Composer is a dependency manager for PHP. Versions 1.0 throu…7.8
• CVE-2026-40177ajenti.plugin.core defines all necessary core elements to al…7.5
• CVE-2026-40178ajenti.plugin.core defines all necessary core elements to al…5.9
• CVE-2026-40179Prometheus is an open-source monitoring system and time seri…6.1
• CVE-2026-4018TOCTOU Race Condition in specific trace commands of the Trac…6.4
• CVE-2026-40181React Router is a router for React. In versions 7.0.0 throug…6.1
• CVE-2026-40182OpenTelemetry dotnet is a dotnet telemetry framework. From 1…5.9
• CVE-2026-40183ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-40184TREK is a collaborative travel planner. Prior to 2.7.2, TREK…5.3
• CVE-2026-40185TREK is a collaborative travel planner. Prior to 2.7.2, TREK…6.5
• CVE-2026-40186ApostropheCMS is an open-source Node.js content management s…6.1