CVE-2026-40180

OVERVIEW CVE-2026-40180 is a path traversal vulnerability in Quarkus OpenAPI Generator, an extension for generating REST clients and server stubs. The flaw exists in the unzip() method of ApicurioCodegenWrapper.java in versions prior to 2.16.0 and 2.15.0-lts. The vulnerability permits extraction of malicious ZIP archives containing path traversal sequences that write files outside the intended output directory, potentially compromising system integrity. SEVERITY The vulnerability requires local access to exploit, as it depends on processing a malicious ZIP file during code generation. The attack is relatively straightforward with low complexity, as it exploits insufficient path validation during archive extraction. A successful attack could result in arbitrary file write capabilities on the affected system, enabling attackers to inject malicious code into generated Java files or overwrite critical application files. The FAUCET Risk Score of 48.0/100 indicates moderate concern from a risk perspective. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from CISA's Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat hot lists. The extremely low EPSS score of 0.00058 suggests minimal practical exploitation likelihood. No public exploit code availability has been reported, though the technical simplicity of path traversal attacks means exploitation could be straightforward for motivated threat actors with access to the affected software.