# CVE-2025-67030: Codehaus Plexus plexus-utils directory traversal in Expand.extractFile

Source: https://junglewise.ai/threats/cve-2025-67030-codehaus-plexus-plexus-utils-directory-traversal-in-expand  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-67030 · Severity: high · CVSS 8.8 · Published 2026-03-25

A security vulnerability exists in a common Java utility library used for file operations and archive extraction. An attacker can create a specially crafted archive file (like a ZIP) that, when opened by an application using this library, writes files to unintended locations on the server. This could allow an attacker to overwrite critical system files or plant malicious code, potentially leading to a full system takeover.

Technologies: [org.codehaus.plexus:plexus-utils (Maven)](https://junglewise.ai/threats/technologies/org-codehaus-plexus-plexus-utils). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-67030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67030 being exploited in the wild.

**How severe is CVE-2025-67030?** High severity, with a CVSS score of 8.8, published 25 March 2026.

**Which products and versions are affected?** Codehaus-Plexus Plexus-Utils before 3.6.1; org.codehaus.plexus:plexus-utils (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.

**Is there a fix for CVE-2025-67030?** Yes. org.codehaus.plexus:plexus-utils (Maven): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-67030 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-67030?** Check whether you run Codehaus-Plexus Plexus-Utils or org.codehaus.plexus:plexus-utils (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.codehaus.plexus:plexus-utils (Maven): upgrade to 4.0.3 or later

  ```sh
  # set org.codehaus.plexus:plexus-utils to 4.0.3 in your pom.xml or build.gradle
  ```


## Technical details

A directory traversal (Zip Slip) vulnerability exists in the 'extractFile' method of 'org.codehaus.plexus.util.Expand' within the plexus-utils library. The root cause is an insufficient path validation check that used 'getAbsolutePath().startsWith()' instead of comparing canonical paths. This allowed attackers to bypass the check using partial prefix matches (e.g., '/tmp/app' matching '/tmp/app-data') or symbolic links. An attacker can exploit this by providing a malicious archive containing entries with '../' sequences, leading to arbitrary file writes outside the target directory. The vulnerability is fixed in version 3.6.1 by implementing canonical path comparison and ensuring the target directory is followed by a file separator during validation.

## Affected products

- Codehaus Plexus plexus-utils before 3.6.1
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1
- Red Hat Red Hat build of Quarkus 3.20.6
- Red Hat Red Hat build of Apache Camel 4.18.1

## Identifiers

- CVE-2025-67030
- GHSA-6fmv-xxpf-w3cw

## Timeline

- 2025-09-02: disclosed: Issue reported on GitHub repository
- 2026-03-25: advisory: CVE published
- 2026-04-02: patched: Version 3.6.1 released with fix

## References

- [https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec](https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec)
- [https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642](https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642)
- [https://github.com/codehaus-plexus/plexus-utils/issues/294](https://github.com/codehaus-plexus/plexus-utils/issues/294)
- [https://github.com/codehaus-plexus/plexus-utils/pull/295](https://github.com/codehaus-plexus/plexus-utils/pull/295)
- [https://github.com/codehaus-plexus/plexus-utils/pull/296](https://github.com/codehaus-plexus/plexus-utils/pull/296)
- [https://access.redhat.com/errata/RHSA-2026:17668](https://access.redhat.com/errata/RHSA-2026:17668)
- [https://access.redhat.com/errata/RHSA-2026:18054](https://access.redhat.com/errata/RHSA-2026:18054)

## Related threats

- [plexus-codehaus vulnerable to directory traversal](https://junglewise.ai/threats/cve-2022-4244-plexus-codehaus-vulnerable-to-directory-traversal)
- [codehaus-plexus vulnerable to XML injection](https://junglewise.ai/threats/cve-2022-4245-codehaus-plexus-vulnerable-to-xml-injection)
- [OS Command Injection in Plexus-utils](https://junglewise.ai/threats/cve-2017-1000487-os-command-injection-in-plexus-utils)