A critical path traversal vulnerability in VMware Spring Data Geode and Gemfire allows remote attackers to perform unauthorized file writes, potentially leading to system compromise.

This is a relative path traversal vulnerability (CWE-23) within the import snapshot functionality. The vulnerability is triggered by an unauthenticated attacker who can manipulate archive paths to write files outside of the intended directory on Windows systems.

Successful exploitation allows an attacker to overwrite critical system files or place malicious executables, potentially resulting in full system compromise or remote code execution. With a CVSS score of 8.2, this vulnerability represents a high risk to organizational data integrity and availability, particularly for environments running these services on Windows.

Immediate Action: Review the official VMware security advisory to identify the specific patched versions for your deployment and apply them as a priority. If a patch is not yet available, restrict access to the import snapshot functionality to trusted administrators only.

Proactive Monitoring: Monitor file system integrity and review application logs for unusual file paths or directory traversal patterns during snapshot import operations.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network security control to inspect incoming traffic and block requests containing directory traversal sequences.

Public Exploit Available: No

Given the potential for unauthorized file writes and the high CVSS severity, organizations should prioritize the identification and patching of all affected Spring Data instances. Organizations should evaluate their exposure on Windows hosts and apply vendor-supplied updates immediately upon release to prevent potential exploitation.