GitHub Advisoryadvisory · Maven

GHSA-6fmv-xxpf-w3cw Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

HIGH Published 2026-03-25 Modified 2026-04-08 Official page ↗
Aliases
CVE-2025-67030
Ecosystem
Maven
Packages
org.codehaus.plexus:plexus-utils
Severity
High
Weaknesses
CWE-22
Reviewed
2026-03-27

Affected packages

• Maven org.codehaus.plexus:plexus-utils: >= 4.0.0, < 4.0.3 → fixed in 4.0.3 • Maven org.codehaus.plexus:plexus-utils: < 3.6.1 → fixed in 3.6.1

Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Related

Alias · CVE (1)

  • CVE-2025-67030 Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References