GHSA-JX2W-VP7F-456Q quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension Details The unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.13) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.13)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.6.1), org.kie.kogito.examples:conversion-workflow (1.22.1.final) +27 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.6.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.16) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.16)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.1.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.1.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.4.1), io.quarkiverse.openapi.generator:quarkus-openapi-generator-generation-input (0.4.1) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.4.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.5.0), org.kie.kogito.examples:conversion-workflow (1.22.0.final) +27 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.5.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.3.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.3.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.5) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.5)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.3.1) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.3.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.4) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.4)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.1) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.3.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.3.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.2.1), org.kie.kogito:integration-tests-data-index-service-quarkus-devservice (1.42.0.final) +23 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.2.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.2.0), org.kie.kogito:integration-tests-jobs-service-quarkus-knative-eventing (>=1.33.0.final, <=1.34.0.final) +15 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.2.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.0.1) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.0.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.0.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.0.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.12.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.30.0.final, <=1.32.0.final) +9 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.12.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.11.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.28.0.final, <=1.29.0.final) +9 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.11.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.10.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.10.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...