Loading vulnerability…
Directory Traversal in Plexus Utils Expand.extractFile
CVE-2025-67030 is a directory traversal vulnerability in the org.codehaus.plexus.util.Expand.extractFile method of Plexus Utils. When vulnerable software extracts attacker-controlled archive entries, crafted entry paths can escape the intended extraction directory, potentially allowing arbitrary code execution. Fixed releases include Plexus Utils 3.6.1 in the 3.x branch and 4.0.3 in the 4.x branch.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary code execution and compromise the confidentiality, integrity, and availability of the affected application and resources accessible to its process. Directory traversal during extraction can permit files to be written outside the intended destination. The listed CVSS v3.0 assessment assigns high confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
Until updates can be applied, prevent untrusted parties from supplying archives or extraction inputs processed by Plexus Utils. Restrict write permissions for the extraction process, isolate extraction workloads, and monitor for unexpected file writes outside approved extraction locations.
Patch, then assume compromise.
Upgrade org.codehaus.plexus:plexus-utils to version 3.6.1 or later in the 3.x branch, or version 4.0.3 or later in the 4.x branch. For products bundling the dependency, apply the corresponding vendor security update rather than replacing bundled libraries without vendor guidance. Identified fixed product releases include JBoss EAP 8.1.6, Bamboo Data Center 12.1.7/10.2.19/9.6.26, and VMware Tanzu Data Flow on Kubernetes 2.0.6/2.1.1.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.