GitHub Advisoryadvisory · Maven

GHSA-5458-7hh9-v7p4 pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

HIGH Published 2026-03-25 Modified 2026-03-27 Official page ↗
Aliases
CVE-2025-70952
Ecosystem
Maven
Packages
org.pf4j:pf4j
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22, CWE-23
Reviewed
2026-03-27

Affected packages

• Maven org.pf4j:pf4j: < 3.14.1 → fixed in 3.14.1

Description

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

Related

Alias · CVE (1)

  • CVE-2025-70952 pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References