CVE-2025-67030
published 2026-03-25CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642…
PriorityP350high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.66%
47.6th percentile
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codehaus-plexus | plexus-utils | < 3.6.1 | 3.6.1 |
| codehaus-plexus | plexus-utils | >= 4.0.0 < 4.0.3 | 4.0.3 |
| debian | plexus-utils2 | — | — |
| msrc | azl3_plexus-utils_3.3.0-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_javapackages-bootstrap_1.5.0-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_plexus-utils_3.3.0-3_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
ghsa·2026-03-25
CVE-2025-67030 [HIGH] CWE-22 Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
OSV
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
osv·2026-03-25
CVE-2025-67030 [HIGH] Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
OSV
CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org
osv·2026-03-25·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Red Hat
org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
vendor_redhat·2026-03-25·CVSS 8.8
CVE-2025-67030 [HIGH] CWE-22 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package:
Microsoft
CVE-2025-67030: Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
vendor_msrc·2026-03-10·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030: Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Debian
CVE-2025-67030: plexus-utils2 - Directory Traversal vulnerability in the extractFile method of org.codehaus.plex...
vendor_debian·2025·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030: plexus-utils2 - Directory Traversal vulnerability in the extractFile method of org.codehaus.plex...
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-67030 plexus-utils: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
bugzilla·2026-04-07·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030 plexus-utils: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
CVE-2025-67030 plexus-utils: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-67030 plexus-utils4: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
bugzilla·2026-04-07·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030 plexus-utils4: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
CVE-2025-67030 plexus-utils4: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-67030 javapackages-bootstrap: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
bugzilla·2026-04-07·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030 javapackages-bootstrap: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
CVE-2025-67030 javapackages-bootstrap: Plexus-utils: Directory Traversal in extractFile method [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-67030 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
bugzilla·2026-03-25·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
CVE-2025-67030 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Wiz
CVE-2025-67030 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2025-67030 [HIGH] CVE-2025-67030 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-67030 :
Java vulnerability analysis and mitigation
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Source : NVD
## 8.8
Score
Published March 25, 2026
Severity HIGH
CNA Score 8.8
Affected Technologies
Java
Maven
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 47.9
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
javapackages-tools:201801::maven-artifact-transfer-javadoc
javapackages-tools:201801::plexus-containers-container-default
Sources
NVD
Chainguard Has Fix Added at: Mar 29, 2026
Deb
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241echttps://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642https://github.com/codehaus-plexus/plexus-utils/issues/294https://github.com/codehaus-plexus/plexus-utils/pull/295https://github.com/codehaus-plexus/plexus-utils/pull/296https://access.redhat.com/errata/RHSA-2026:17668https://access.redhat.com/errata/RHSA-2026:18054https://access.redhat.com/errata/RHSA-2026:18055https://access.redhat.com/errata/RHSA-2026:18059https://access.redhat.com/errata/RHSA-2026:35990https://access.redhat.com/errata/RHSA-2026:35991https://access.redhat.com/errata/RHSA-2026:35992https://access.redhat.com/errata/RHSA-2026:35996https://access.redhat.com/errata/RHSA-2026:35997https://access.redhat.com/errata/RHSA-2026:36012https://access.redhat.com/errata/RHSA-2026:38500https://access.redhat.com/errata/RHSA-2026:38514https://access.redhat.com/errata/RHSA-2026:38796https://access.redhat.com/errata/RHSA-2026:40841https://access.redhat.com/errata/RHSA-2026:7109https://access.redhat.com/errata/RHSA-2026:7380https://access.redhat.com/security/cve/CVE-2025-67030https://bugzilla.redhat.com/show_bug.cgi?id=2451409https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json
2026-03-25
Published