CVE-2025-67030
March 25, 2026
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Affected Packages
org.codehaus.plexus:plexus-utils (JAVA):
Affected version(s) >=1.0.4 <4.0.3Fix Suggestion:
Update to version 4.0.3org.codehaus.plexus:plexus-utils (JAVA):
Affected version(s) >=1.0.4 <4.0.3Fix Suggestion:
Update to version 4.0.3org.codehaus.plexus:plexus-utils (JAVA):
Affected version(s) >=1.0.4 <4.0.3Fix Suggestion:
Update to version 4.0.3org.codehaus.plexus:plexus-utils (JAVA):
Affected version(s) >=1.0.4 <4.0.3Fix Suggestion:
Update to version 4.0.3org.codehaus.plexus:plexus-utils (JAVA):
Affected version(s) >=1.0.4 <4.0.3Fix Suggestion:
Update to version 4.0.3Related Resources (8)
Do you need more information?
Contact UsCVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS
Base Score:
0.04
