{"id":"CVE-2026-75598","aliases":["EUVD-2026-118393","GHSA-rr8v-fxxf-c986"],"status":"published","title":"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization","description":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0014,"percentile":0.03436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-11-06T17:51:29Z","modified":"2026-11-09T22:00:07Z","fixes":[{"ecosystem":"Maven","package":"com.gradleup.shadow:com.gradleup.shadow.gradle.plugin","fixed_in":["9.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.gradleup.shadow:com.gradleup.shadow.gradle.plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.gradleup.shadow:com.gradleup.shadow.gradle.plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.0"}]}],"versions":["8.3.0","8.3.1","8.3.10","8.3.11","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","9.0.0","9.0.0-beta1","9.0.0-beta10","9.0.0-beta11","9.0.0-beta12","9.0.0-beta13","9.0.0-beta14","9.0.0-beta15","9.0.0-beta16","9.0.0-beta17","9.0.0-beta2","9.0.0-beta3","9.0.0-beta4","9.0.0-beta5","9.0.0-beta6","9.0.0-beta7","9.0.0-beta8","9.0.0-beta9","9.0.0-rc1","9.0.0-rc2","9.0.0-rc3","9.0.1","9.0.2","9.1.0","9.2.0","9.2.1","9.2.2","9.3.0","9.3.1","9.3.2","9.4.0","9.4.1","9.4.2","9.4.3","9.5.0","9.5.1"]}],"products":[{"vendor":"doomsider","product":"shadow"},{"vendor":"gradleup","product":"shadow"}],"references":[{"url":"https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/GradleUp/shadow/releases/tag/9.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75598","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rr8v-fxxf-c986"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75598.json","tags":["advisory"]},{"url":"https://github.com/GradleUp/shadow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-75598","title":"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization","description":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.","status":"published","published":"2026-11-06T17:51:29.813Z","modified":"2026-11-09T13:12:10.248Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T14:33:34.013968Z"}],"euvd":[{"id":"EUVD-2026-118393","description":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.","status":"published","published":"2026-11-06T17:51:29Z","modified":"2026-11-09T13:12:10Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-10T00:18:47.526338Z"}],"ghsa":[{"id":"GHSA-rr8v-fxxf-c986","title":"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization","description":"### Summary\nShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences (e.g. `../../../../tmp/pwned.txt`) in entry names will have those entries reproduced verbatim in the output shadow JAR.\n\n### Details\nThe vulnerability exists because Shadow relies entirely on Gradle's ZipFileTree for entry sanitization rather than implementing its own path validation. This means:\n\n1. Users on Gradle \u003c 7.6.2 / 8.x \u003c 8.2.0 are directly exploitable\n2. The produced shadow JAR becomes a Zip Slip weapon against any \ndownstream consumer using unprotected extraction (raw ZipInputStream, \nolder CI tooling, custom Java unpackers)\n3. If Shadow ever uses a non-ZipFileTree code path, protection \ndisappears silently\n\nAffected file: `src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/internal/ShadowCopyAction.kt`\n\n### PoC\n1. Create a malicious JAR with path traversal entry:\n```python\nimport zipfile\nwith zipfile.ZipFile('evil.jar', 'w') as zf:\n    zf.writestr('../../../../tmp/zipslip_proof.txt', 'pwned')\n```\n2. Add as dependency in a shadow project\n3. Run `gradle shadowJar`\n4. Run `unzip -l build/libs/*.jar | grep \"\\.\\.\"`\n5. Traversal entry survives in output JAR\n\n### Impact\nAny tool extracting the shadow JAR with unprotected extraction is subject to arbitrary file overwrite. Users on older Gradle versions  are directly vulnerable at build time.","status":"published","published":"2026-11-09T21:48:13Z","modified":"2026-11-09T21:48:15Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T21:50:00.934325Z"}],"nvd":[{"id":"CVE-2026-75598","description":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.","status":"published","published":"2026-11-06T18:18:18.88Z","modified":"2026-11-09T13:17:08.843Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T16:14:55.273195Z"}],"osv":[{"id":"CVE-2026-75598","title":"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization","description":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.","status":"published","published":"2026-11-06T17:51:29.813Z","modified":"2026-11-10T02:30:36.500695484Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-08T03:29:44.777002Z"},{"id":"GHSA-rr8v-fxxf-c986","title":"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization","description":"### Summary\nShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences (e.g. `../../../../tmp/pwned.txt`) in entry names will have those entries reproduced verbatim in the output shadow JAR.\n\n### Details\nThe vulnerability exists because Shadow relies entirely on Gradle's ZipFileTree for entry sanitization rather than implementing its own path validation. This means:\n\n1. Users on Gradle \u003c 7.6.2 / 8.x \u003c 8.2.0 are directly exploitable\n2. The produced shadow JAR becomes a Zip Slip weapon against any \ndownstream consumer using unprotected extraction (raw ZipInputStream, \nolder CI tooling, custom Java unpackers)\n3. If Shadow ever uses a non-ZipFileTree code path, protection \ndisappears silently\n\nAffected file: `src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/internal/ShadowCopyAction.kt`\n\n### PoC\n1. Create a malicious JAR with path traversal entry:\n```python\nimport zipfile\nwith zipfile.ZipFile('evil.jar', 'w') as zf:\n    zf.writestr('../../../../tmp/zipslip_proof.txt', 'pwned')\n```\n2. Add as dependency in a shadow project\n3. Run `gradle shadowJar`\n4. Run `unzip -l build/libs/*.jar | grep \"\\.\\.\"`\n5. Traversal entry survives in output JAR\n\n### Impact\nAny tool extracting the shadow JAR with unprotected extraction is subject to arbitrary file overwrite. Users on older Gradle versions  are directly vulnerable at build time.","status":"published","published":"2026-11-09T21:48:13Z","modified":"2026-11-09T22:00:07.654775352Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-09T22:10:51.322704Z"}]}}