A zip‑slip path‑traversal flaw exists in VMware's Spring Data Geode import snapshot functionality that allows a crafted snapshot file to extract files outside the intended directory on Windows. This can cause unintentionally created or overwritten files, potentially exposing sensitive application data or affecting application stability. The weakness matches the common path‑traversal categories identified by CWE‑22 and CWE‑23.

The vulnerability impacts VMware Spring Data Gemfire and Spring Data Geode when they run on Windows. No explicit version range is disclosed; therefore all Windows installations using either component should be reviewed until a vendor fix is released.

The CVSS score of 8.2 indicates a high severity, while the EPSS score of less than 1 % suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an authorized user providing a crafted snapshot file to the import mechanism; the exact prerequisites are not documented, so this inference remains preliminary.