PT-2026-20882

Name of the Vulnerable Software and Affected Versions Spring Data Geode affected versions not specified Description The software has a flaw related to insecure directory usage during snapshot imports. Specifically, archives are extracted into predictable and overly permissive directories within t...

CVE-2026-2817: Insertion of Sensitive Information into Externally-Accessible File or Directory

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +4 more potentially affected by CVE-2026-23903 via org.apache.shiro:shiro-spring (1.3.1)

org.apache.shiro:shiro-spring MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-spring and may be impacted: - com.netflix.ndbench:ndbench-cli =0.3.12, =0.3.5, =0.7.4 - org.apache.shiro.samples:samples-sprhib 1.3...