io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.4) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.4)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.16) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.16)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.6.1), org.kie.kogito.examples:conversion-workflow (1.22.1.final) +27 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.6.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.11) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.11)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.3.1) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.3.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.4.1), io.quarkiverse.openapi.generator:quarkus-openapi-generator-generation-input (0.4.1) potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.4.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.11.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.28.0.final, <=1.29.0.final) +9 more potentially affected by CVE-2026-42333 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.11.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

CVE-2026-40180

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output...

CVE-2026-40180

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output...

CVE-2026-40180

CVE-2026-40180 affects Quarkus OpenAPI Generator’s ApicurioCodegenWrapper unzip() path: entries are extracted without validating that the resolved path stays inside the output directory, constructing destination as new File(toOutputDir, entry.getName()). This can allow path traversal (e.g., ../.....

io.github.onecx.quarkus:onecx-permissions (>=0.5.0, <=0.7.0), io.github.onecx.quarkus:onecx-permissions-client (>=0.5.0, <=0.7.0) +122 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (>=0.1.0, <=2.15.0-lts)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version =0.1.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.0.1, =0.0.1, =0.1.0, =2.2.13, =0.4.0, =2.7.0, =10.0.0, =10.0.0, =10.2.0 and more Source cves: CVE-2026-40180https:...

CVE-2026-40180

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output...

Quarkus OpenAPI Generator: Path traversal vulnerability

Quarkus OpenAPI Generator is an open-source code generation tool based on the OpenAPI specification, developed by Quarkiverse Hub. Versions of Quarkus OpenAPI Generator prior to 2.16.0 and 2.15.0-lts contained a path traversal vulnerability. This vulnerability stemmed from the unzip method in...

CVE-2026-40180: Improper Limitation of a Pathname to a Restricted Directory

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output...

GHSA-JX2W-VP7F-456Q quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension Details The unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.13) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.13)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.6.1), org.kie.kogito.examples:conversion-workflow (1.22.1.final) +27 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.6.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.16) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.16)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.github.onecx.quarkus:onecx-permissions (>=0.5.0, <=0.7.0), io.github.onecx.quarkus:onecx-permissions-client (>=0.5.0, <=0.7.0) +76 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (>=2.0.0, <=2.15.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version =2.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.0.1, =0.0.1, =2.0.0, =2.2.13, =2.7.0, =10.0.0, =10.0.0, =10.0.0, =10.2.0 and more Source cves: CVE-2026-40180https://...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.1.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.1.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...