Junglewise Threat Intelligence

CVE-2025-67030: Codehaus Plexus plexus-utils directory traversal in Expand.extractFile

CVE-2025-67030 · Severity: high · CVSS 8.8 · Published 2026-03-25

Vendors: Red Hat.

Executive brief

A security vulnerability exists in a common Java utility library used for file operations and archive extraction. An attacker can create a specially crafted archive file (like a ZIP) that, when opened by an application using this library, writes files to unintended locations on the server. This could allow an attacker to overwrite critical system files or plant malicious code, potentially leading to a full system takeover.

Technical details

A directory traversal (Zip Slip) vulnerability exists in the 'extractFile' method of 'org.codehaus.plexus.util.Expand' within the plexus-utils library. The root cause is an insufficient path validation check that used 'getAbsolutePath().startsWith()' instead of comparing canonical paths. This allowed attackers to bypass the check using partial prefix matches (e.g., '/tmp/app' matching '/tmp/app-data') or symbolic links. An attacker can exploit this by providing a malicious archive containing entries with '../' sequences, leading to arbitrary file writes outside the target directory. The vulnerability is fixed in version 3.6.1 by implementing canonical path comparison and ensuring the target directory is followed by a file separator during validation.

Affected products

  • Codehaus Plexus plexus-utils before 3.6.1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat build of Quarkus 3.20.6
  • Red Hat Red Hat build of Apache Camel 4.18.1

Timeline

  • 2025-09-02: disclosed: Issue reported on GitHub repository
  • 2026-03-25: advisory: CVE published
  • 2026-04-02: patched: Version 3.6.1 released with fix

References