CVE-2026-40180: Quarkus openapi generator Path Traversal Vulnerability

MODERATE
Advisory Identifier: GHSA-jx2w-vp7f-456q
Share
CWE-22
Published
Advisory Summary

CVE-2026-40180 is a MODERATE path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Quarkus openapi generator libraries in the Maven ecosystem. The issue involves quarkus-openapi-generator extension has zip slip path traversal in apicuriocodegenwrapper class. Remediation is available by upgrading affected packages to version 2.16.0.

CVE-2026-40180 at a Glance

CVE Identifier CVE-2026-40180
GHSA Identifier GHSA-jx2w-vp7f-456q
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Quarkus openapi generator
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-40180

To remediate this vulnerability, upgrade all affected Quarkus openapi generator dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

io.quarkiverse.openapi.generator:quarkus-openapi-generator fixed: 2.16.0 
<dependency>
    <groupId>io.quarkiverse.openapi.generator</groupId>
    <artifactId>quarkus-openapi-generator</artifactId>
    <version>2.16.0</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generator

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-40180, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generator

Analyze the terminal output to locate any version of Quarkus openapi generator in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.16.0), your application is affected.

Note: The mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generator command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Quarkus openapi generator, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension ### Details The `unzip()` method in `ApicurioCodegenWrapper.java` extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as `new File(toOutputDir, entry.getName())` and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., `../../malicious.java`) would write files outside the target directory. The interesting thing is that the client module in the same repository already has the correct fix. `OpenApiGeneratorStreamCodeGen.java` at line 137 performs proper `normalize()` and `startsWith()` validation. The server module was simply missed. ### PoC This vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time. 1. Create a ZIP file containing an entry named `../../proof.txt` with arbitrary content 2. Configure quarkus-openapi-generator to use the server (Apicurio) code generation path 3. Serve the malicious ZIP from a controlled or MITM'd Apicurio registry endpoint 4. Trigger code generation 5. Observe that `proof.txt` is written two directories above the intended output ### Impact An attacker who can serve a crafted ZIP to the code generation pipeline could write arbitrary files on the build machine. This could overwrite source files, inject malicious code into the build output, or modify configuration files. In CI/CD environments, this could lead to supply chain compromise.

CVE-2026-40180 Affected Quarkus openapi generator Versions

1 component(s)
Fixed Versions:
2.16.0
Product / Package Ecosystem Affected Versions Fixed Version
io.quarkiverse.openapi.generator:quarkus-openapi-generator
maven/io.quarkiverse.openapi.generator/quarkus-openapi-generator
Maven
< 2.16.0
2.16.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q
NVD — CVE-2026-40180 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40180
Security Fix Commit FIX COMMIT
https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0
Security Fix Commit FIX COMMIT
https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239
Quarkus openapi generator Source Repository REPOSITORY
https://github.com/quarkiverse/quarkus-openapi-generator

Frequently Asked Questions

What is CVE-2026-40180?
CVE-2026-40180 is a security vulnerability in Quarkus openapi generator involving quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Quarkus openapi generator versions are affected?
Affected versions include releases prior to 2.16.0 across affected packages: io.quarkiverse.openapi.generator:quarkus-openapi-generator.
What version fixes CVE-2026-40180?
Upgrading to 2.16.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is quarkus-openapi-generator affected?
Yes, io.quarkiverse.openapi.generator:quarkus-openapi-generator is affected in releases prior to 2.16.0. Upgrade your dependency to 2.16.0 or later.
What CWE is associated with CVE-2026-40180?
CVE-2026-40180 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Maven dependencies for CVE-2026-40180?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generator'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jx2w-vp7f-456q",
  "modified" : "2026-04-10T21:36:53Z",
  "published" : "2026-04-08T19:14:32Z",
  "aliases" : [ "CVE-2026-40180" ],
  "summary" : "quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class",
  "details" : "### Summary\nA path traversal vulnerability was discovered in the quarkus-openapi-generator extension\n\n### Details\nThe `unzip()` method in `ApicurioCodegenWrapper.java` extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as `new File(toOutputDir, entry.getName())` and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., `../../malicious.java`) would write files outside the target directory.\n\nThe interesting thing is that the client module in the same repository already has the correct fix. `OpenApiGeneratorStreamCodeGen.java` at line 137 performs proper `normalize()` and `startsWith()` validation. The server module was simply missed.\n\n### PoC\nThis vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time.\n\n1. Create a ZIP file containing an entry named `../../proof.txt` with arbitrary content\n2. Configure quarkus-openapi-generator to use the server (Apicurio) code generation path\n3. Serve the malicious ZIP from a controlled or MITM'd Apicurio registry endpoint\n4. Trigger code generation\n5. Observe that `proof.txt` is written two directories above the intended output\n\n\n### Impact\nAn attacker who can serve a crafted ZIP to the code generation pipeline could write arbitrary files on the build machine. This could overwrite source files, inject malicious code into the build output, or modify configuration files. In CI/CD environments, this could lead to supply chain compromise.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.quarkiverse.openapi.generator:quarkus-openapi-generator"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.16.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.15.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40180"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/quarkiverse/quarkus-openapi-generator"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-08T19:14:32Z",
    "nvd_published_at" : "2026-04-10T20:16:23Z"
  }
}