CVE-2025-67030

EUVD-2025-209002
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 48.29%
Affected Products (NVD)
VendorProductVersion
codehaus-plexusplexus-utils
𝑥
< 3.6.1
codehaus-plexusplexus-utils
4.0.0 ≤
𝑥
< 4.0.3
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:3.5.1-9.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:3.5.1-8.el10_0.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260520141024.b249b32d ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260520141124.88f2bc72 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
8080020260615155417.a1d5b3e2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
8080020260615155417.a1d5b3e2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
9080020260520135357.470dcefd ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:3.3.0-14.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:3.3.0-10.el9_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0:3.3.0-10.el9_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:3.3.0-13.el9_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
9060020260612145814.470dcefd ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.40.0-6.redhat_00012.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.0.5-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.0.3-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:1.84.0-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:801.6.0-1.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:1.0.3-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:33.0.0-3.jre_redhat_00004.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:3.7.19-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:6.6.48-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:7.2.6-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.1.4-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:3.6.2-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:16.1.0-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.0.6-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.1.132-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.1.132-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:3.6.1-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:3.1.12-1.redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.2.21-5.redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.6-5.GA_redhat_00007.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:1.0.1-4.Final_redhat_00002.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.1.4-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.1-10.GA_redhat_00017.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.3.0-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:2.3.0-1.Final.redhat.00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:3.0.4-5.redhat_00007.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.40.0-6.redhat_00012.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.0.5-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.0.3-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:1.84.0-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:801.6.0-1.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:1.0.3-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:33.0.0-3.jre_redhat_00004.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:3.7.19-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:6.6.48-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:7.2.6-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.1.4-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:3.6.2-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:16.1.0-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.0.6-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.1.132-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.1.132-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:3.6.1-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:3.1.12-1.redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.2.21-5.redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.6-5.GA_redhat_00007.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:1.0.1-4.Final_redhat_00002.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.1.4-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.1-10.GA_redhat_00017.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.3.0-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:2.3.0-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:3.0.4-5.redhat_00007.1.el9eap ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
plexus-utils2
bookworm
no-dsa
bullseye
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
plexus-utils
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
plexus-utils
RHEL 9
0:3.3.0-14.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
maven3.9
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-amazon-corretto11
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-amazon-corretto17
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-amazon-corretto21
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-amazon-corretto8
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-javadoc
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
maven3.9-lib
Amazon Linux 2023
1:3.9.14-3.amzn2023.0.1
fixed
plexus-utils
Amazon Linux 2
0:3.0.9-9.amzn2.0.1
fixed
Amazon Linux 2023
0:3.3.0-9.amzn2023.0.5
fixed
plexus-utils-javadoc
Amazon Linux 2
0:3.0.9-9.amzn2.0.1
fixed
Amazon Linux 2023
0:3.3.0-9.amzn2023.0.5
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
plexus-utils
Azure Linux 3.0
0:3.3.0-5.azl3
fixed
CBL-Mariner 2.0
0:3.3.0-4.cm2
fixed
Common Weakness Enumeration
References
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
https://github.com/codehaus-plexus/plexus-utils/issues/294
https://github.com/codehaus-plexus/plexus-utils/pull/295
https://github.com/codehaus-plexus/plexus-utils/pull/296
https://access.redhat.com/errata/RHSA-2026:17668
https://access.redhat.com/errata/RHSA-2026:18054
https://access.redhat.com/errata/RHSA-2026:18055
https://access.redhat.com/errata/RHSA-2026:18059
https://access.redhat.com/errata/RHSA-2026:35990
https://access.redhat.com/errata/RHSA-2026:35991
https://access.redhat.com/errata/RHSA-2026:35992
https://access.redhat.com/errata/RHSA-2026:35996
https://access.redhat.com/errata/RHSA-2026:35997
https://access.redhat.com/errata/RHSA-2026:36012
https://access.redhat.com/errata/RHSA-2026:38500
https://access.redhat.com/errata/RHSA-2026:38514
https://access.redhat.com/errata/RHSA-2026:38796
https://access.redhat.com/errata/RHSA-2026:40841
https://access.redhat.com/errata/RHSA-2026:41948
https://access.redhat.com/errata/RHSA-2026:7109
https://access.redhat.com/errata/RHSA-2026:7380
https://access.redhat.com/security/cve/CVE-2025-67030
https://bugzilla.redhat.com/show_bug.cgi?id=2451409
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json