{"action":"Upgrade com.vaadin:flow-project to 14.14.1 (14.x), 23.6.7 (23.x), 24.9.9 (24.x) or 25.0.3 (25.x) or later.","affected":[{"fixed":"14.14.1","introduced":"14.2.0"},{"fixed":"23.6.7","introduced":"23.0.0"},{"fixed":"24.9.9","introduced":"24.0.0"},{"fixed":"25.0.3","introduced":"25.0.0"}],"component":"com.vaadin:flow-project","cve_ids":["CVE-2026-2741"],"ecosystem":"Maven","epss":0.00389,"exploited":false,"fixed_versions":["14.14.1","23.6.7","24.9.9","25.0.3"],"ghsa_id":"GHSA-8jrh-7jg8-fvmv","id":"tcs_01M5N8N04MWWGWB3SV7RGGMZ4T","modified_at":"2026-03-14T02:41:21.625559Z","published_at":"2026-03-10T18:31:22Z","references":["https://osv.dev/vulnerability/GHSA-8jrh-7jg8-fvmv","https://nvd.nist.gov/vuln/detail/CVE-2026-2741","https://github.com/vaadin/flow/pull/23125","https://github.com/vaadin/flow/pull/23130","https://github.com/vaadin/flow/pull/23131","https://github.com/vaadin/flow/pull/23133","https://github.com/vaadin/flow/pull/23135","https://github.com/vaadin/flow","https://vaadin.com/security/cve-2026-2741"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-8jrh-7jg8-fvmv","url":"https://osv.dev/vulnerability/GHSA-8jrh-7jg8-fvmv"},{"source":"nvd","source_id":"CVE-2026-2741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2741"}],"summary":"Vaadin: Specially crafted ZIP archives can escape the intended extraction directory"}