CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2025-67030
High (8.8) in codehaus-plexus plexus-utils. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.codehaus.plexus:plexus-utils 3.6.1, 4.0.3.
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- codehaus-plexus:plexus-utils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6fmv-xxpf-w3cw | Maven | org.codehaus.plexus:plexus-utils | >=4.0.0 <4.0.3 | 4.0.3 |
| GHSA-6fmv-xxpf-w3cw | Maven | org.codehaus.plexus:plexus-utils | <3.6.1 | 3.6.1 |
References
- https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
- https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
- https://github.com/codehaus-plexus/plexus-utils/issues/294
- https://github.com/codehaus-plexus/plexus-utils/pull/295
- https://github.com/codehaus-plexus/plexus-utils/pull/296