CVE-2025-67030

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-67030
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec Third Party Advisory
https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 Patch
https://github.com/codehaus-plexus/plexus-utils/issues/294 Issue Tracking
https://github.com/codehaus-plexus/plexus-utils/pull/295 Issue Tracking Patch
https://github.com/codehaus-plexus/plexus-utils/pull/296 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*
History

01 Apr 2026, 14:15

Type Values Removed Values Added
CPE cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*
First Time Codehaus-plexus plexus-utils
Codehaus-plexus
References () https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec - () https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec - Third Party Advisory
References () https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 - () https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 - Patch
References () https://github.com/codehaus-plexus/plexus-utils/issues/294 - () https://github.com/codehaus-plexus/plexus-utils/issues/294 - Issue Tracking
References () https://github.com/codehaus-plexus/plexus-utils/pull/295 - () https://github.com/codehaus-plexus/plexus-utils/pull/295 - Issue Tracking, Patch
References () https://github.com/codehaus-plexus/plexus-utils/pull/296 - () https://github.com/codehaus-plexus/plexus-utils/pull/296 - Issue Tracking, Patch

27 Mar 2026, 20:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
Summary
  • (es) Vulnerabilidad de salto de directorio en el método extractFile de org.codehaus.plexus.util.Expand en plexus-utils anterior a 6d780b3378829318ba5c2d29547e0012d5b29642. Esto permite a un atacante ejecutar código arbitrario
CWE CWE-22

25 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 18:16

Updated : 2026-04-01 14:15

NVD link : CVE-2025-67030

Mitre link : CVE-2025-67030

CVE.ORG link : CVE-2025-67030

JSON object : View

Products Affected

codehaus-plexus

  • plexus-utils
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')