Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-35946

CVE-2023-35946MEDIUM

gradle gradle — Dependency cache path traversal in Gradle

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  H  N    5.5   .0028   19.5     —

AFFECTED
  Product  Versions   Fixed
  gradle   < 7.6.2 –  —

TIMELINE
  Jun 20  Reserved by GitHub_M
  Jun 30  Published (CNA: GitHub_M)
  Oct 8   RESCORED — CVE-2023-35946 (gradle). CVSS 6.9 → 5.5 (NVD).

CWE-22 · CNA: GitHub_M · CVSS v3.1 · 5 references · NVD status: Modified

Description

Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over another file in the dependency cache. This vulnerability could be used to poison the dependency cache or overwrite important files elsewhere on the filesystem where the Gradle process has write permissions. Exploiting this vulnerability requires an attacker to have control over a dependency repository used by the Gradle build or have the ability to modify the build's configuration. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Gradle will refuse to cache dependencies that have path traversal elements in their dependency coordinates. It is recommended that users upgrade to a patched version. If you are unable to upgrade to Gradle 7.6.2 or 8.2, `dependency verification` will make this vulnerability more difficult to exploit.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 20, 2023	Reserved	Reserved by GitHub_M
June 30, 2023	Published	Published (CNA: GitHub_M)
October 8, 2026	RESCORED	RESCORED — CVE-2023-35946 (gradle). CVSS 6.9 → 5.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
gradle	gradle	—	< 7.6.2	—

Weaknesses

CWE-22

References (5)

https://docs.gradle.org/current/userguide/dependency_verification.html [Product, Vendor Advisory]
https://github.com/gradle/gradle/commit/859eae2b2acf751ae7db3c9ffefe275aa5da0d5d [Patch, Third Party Advisory]
https://github.com/gradle/gradle/commit/b07e528feb3a5ffa66bdcc358549edd73e4c8a12 [Patch, Third Party Advisory]
https://github.com/gradle/gradle/security/advisories/GHSA-2h6c-rv6q-494v [Mitigation, Third Party Advisory]
https://security.netapp.com/advisory/ntap-20230731-0003/ [Third Party Advisory]

Authoritative record: CVE-2023-35946 at cve.org

Vendors: gradle

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-35946 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.