CVE-2026-2741 | Vaadin Flow up to 14.14.0/23.6.6/24.9.8/25.0.2 ZIP Node.js path traversal

A vulnerability marked as critical has been reported in Vaadin Flow up to 14.14.0/23.6.6/24.9.8/25.0.2. Affected by this issue is some unknown functionality of the file Node.js of the component ZIP Handler. The manipulation leads to path traversal.

This vulnerability is referenced as CVE-2026-2741. The attack can only be performed from a local environment. No exploit is available.

It is suggested to upgrade the affected component.