CVE-2026-75598

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.

• CWE-22

• https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd
• https://github.com/GradleUp/shadow/releases/tag/9.6.0
• https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986
• https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986

Published

Nov 6, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75592Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-75593BuildKit is a toolkit for converting source code to build ar…7.2
• CVE-2026-75594Kirby is an open-source content management system. Prior to …8.2
• CVE-2026-75595Netty is an asynchronous, event-driven network application f…9.1
• CVE-2026-75596Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-75597pyLoad is a free and open-source download manager written in…5.3
• CVE-2026-75599HomeBox is a home inventory and organization system. Prior t…5.4
• CVE-2026-75600FreePBX is an open source IP PBX. Prior to version 17.0.9, a…8.8
• CVE-2026-75601Static Web Server (SWS) is a production-ready web server sui…4.3
• CVE-2026-75602OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-75604Next.js is a React framework for building full-stack web app…9
• CVE-2026-75607Frigate is an open source network video recorder. Prior to 0…8.1