CVE-2026-40180: Quarkus openapi generator Path Traversal Vulnerability
MODERATECVE-2026-40180 is a MODERATE path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Quarkus openapi generator libraries in the Maven ecosystem. The issue involves quarkus-openapi-generator extension has zip slip path traversal in apicuriocodegenwrapper class. Remediation is available by upgrading affected packages to version 2.16.0.
CVE-2026-40180 at a Glance
How to Fix CVE-2026-40180
To remediate this vulnerability, upgrade all affected Quarkus openapi generator dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>io.quarkiverse.openapi.generator</groupId>
<artifactId>quarkus-openapi-generator</artifactId>
<version>2.16.0</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generatorHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-40180, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generatorAnalyze the terminal output to locate any version of Quarkus openapi generator in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.16.0), your application is affected.
Note: The mvn dependency:tree -Dincludes=io.quarkiverse.openapi.generator command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Quarkus openapi generator, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-40180 Affected Quarkus openapi generator Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
io.quarkiverse.openapi.generator:quarkus-openapi-generator
|
Maven |
< 2.16.0
|
2.16.0
|
References
Frequently Asked Questions
What is CVE-2026-40180?
Which Quarkus openapi generator versions are affected?
What version fixes CVE-2026-40180?
Is quarkus-openapi-generator affected?
What CWE is associated with CVE-2026-40180?
How can I check Maven dependencies for CVE-2026-40180?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-jx2w-vp7f-456q",
"modified" : "2026-04-10T21:36:53Z",
"published" : "2026-04-08T19:14:32Z",
"aliases" : [ "CVE-2026-40180" ],
"summary" : "quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class",
"details" : "### Summary\nA path traversal vulnerability was discovered in the quarkus-openapi-generator extension\n\n### Details\nThe `unzip()` method in `ApicurioCodegenWrapper.java` extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as `new File(toOutputDir, entry.getName())` and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., `../../malicious.java`) would write files outside the target directory.\n\nThe interesting thing is that the client module in the same repository already has the correct fix. `OpenApiGeneratorStreamCodeGen.java` at line 137 performs proper `normalize()` and `startsWith()` validation. The server module was simply missed.\n\n### PoC\nThis vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time.\n\n1. Create a ZIP file containing an entry named `../../proof.txt` with arbitrary content\n2. Configure quarkus-openapi-generator to use the server (Apicurio) code generation path\n3. Serve the malicious ZIP from a controlled or MITM'd Apicurio registry endpoint\n4. Trigger code generation\n5. Observe that `proof.txt` is written two directories above the intended output\n\n\n### Impact\nAn attacker who can serve a crafted ZIP to the code generation pipeline could write arbitrary files on the build machine. This could overwrite source files, inject malicious code into the build output, or modify configuration files. In CI/CD environments, this could lead to supply chain compromise.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "io.quarkiverse.openapi.generator:quarkus-openapi-generator"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.16.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.15.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40180"
}, {
"type" : "WEB",
"url" : "https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0"
}, {
"type" : "WEB",
"url" : "https://github.com/quarkiverse/quarkus-openapi-generator/commit/e2a9c629a3df719abc74569a3795c265fd0e1239"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/quarkiverse/quarkus-openapi-generator"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-08T19:14:32Z",
"nvd_published_at" : "2026-04-10T20:16:23Z"
}
}