A specially crafted ZIP archive can escape the intended extraction directory when Vaadin automatically downloads and unpacks Node.js. If an attacker can supply the archive—for example, via DNS hijacking, a MITM attack, a compromised mirror, or a supply‑chain compromise—they can write files outside the expected directory, potentially overwriting build artifacts or inserting malicious code. This allows arbitrary file creation or modification inside the Vaadin project workspace, which could compromise confidentiality, integrity, or execution of the build.

The vulnerability affects Vaadin Flow for versions 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin versions 10‑13 and 15‑22 are no longer supported, and users should consider updating to the latest supported releases of 14, 23, 24, or 25.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1 % shows a very small probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to control the Node.js archive download, which can happen through DNS hijacking, a MITM attack, a compromised mirror, or a supply‑chain compromise. When such an attack vector exists, the path‑traversal could enable writing arbitrary files during the build process, potentially leading to code injection or privilege escalation within the build environment.