A vulnerability (CVE-2026-75598) was identified in the Gradle Shadow plugin, affecting versions prior to 9.6.0. The issue arises from the plugin not validating ZIP entry names before writing them to the output archive, allowing malicious dependencies to potentially cause path traversal. This can result in attacker-controlled files being written outside the intended destination when the resulting archive is extracted without path traversal protection. To mitigate this issue, developers should upgrade the Gradle Shadow plugin to version 9.6.0 or later.