CVE-2026-75598

Name of the Vulnerable Software and Affected Versions Gradle Shadow plugin versions prior to 9.6.0

Description The plugin fails to independently validate ZIP entry names before writing them to the output archive. A malicious dependency can preserve traversal entry names if the archive-processing path does not reject them. If the resulting archive is extracted without path traversal protection, files controlled by an attacker can be written outside the intended destination. Note that upgrading Gradle alone may not prevent this behavior in some implementations that process dependency archives directly.

Recommendations Update Gradle Shadow plugin to version 9.6.0.