{"action":"Upgrade com.diffplug.gradle:goomph to 3.37.2 or later.","affected":[{"fixed":"3.37.2","introduced":"0"}],"component":"com.diffplug.gradle:goomph","cve_ids":["CVE-2022-26049"],"ecosystem":"Maven","epss":0.0248,"exploited":false,"fixed_versions":["3.37.2"],"ghsa_id":"GHSA-p2f7-9cv7-jjf6","id":"tcs_01M5N9659PYECX9T2KFR1WZWWR","modified_at":"2026-09-10T03:50:07.415032301Z","published_at":"2022-09-12T00:00:33Z","references":["https://osv.dev/vulnerability/GHSA-p2f7-9cv7-jjf6","https://nvd.nist.gov/vuln/detail/CVE-2022-26049","https://github.com/diffplug/goomph/pull/198","https://github.com/diffplug/goomph/commit/25f04f67ba62d9a14104bee13a0a0f2517afb8c8","https://security.snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGGRADLE-2981040"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-p2f7-9cv7-jjf6","url":"https://osv.dev/vulnerability/GHSA-p2f7-9cv7-jjf6"}],"summary":"Goomph before 3.37.2 allows malicious zip file to write contents to arbitrary locations"}