EUVD-2026-118393

Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization...

CVE-2026-75598

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

CVE-2026-75598

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

PT-2026-138356

Name of the Vulnerable Software and Affected Versions Gradle Shadow plugin versions prior to 9.6.0 Description The plugin fails to independently validate ZIP entry names before writing them to the output archive. A malicious dependency can preserve traversal entry names if the archive-processing...

CVE-2026-75598: GradleUp shadow: The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

OpenMage Magento Lts code issues and vulnerabilities

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A code issue vulnerability exists in OpenMage LTS versions 19.4.22 through 20.0.19, which originates from an administrator who has the right to upload files and create products via DataFlow, and can execute arbitrary code...