Fluid Attacks Database

Description

Plexus-Utils has a Directory Traversal vulnerability in its extractFile method Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel7	maven-install-plugin	-	-
debian 11	plexus-utils2	=3.3.0-1 \|\| =3.3.0-2 \|\| =3.3.0-3 \|\| =3.3.1-1 \|\| =3.4.2-1	-
debian 12	plexus-utils2	=3.4.2-1	-
debian 13	plexus-utils2	=3.4.2-1	-
debian 14	plexus-utils2	=3.4.2-1	-
rpm rhel9	ceph	-	-
rpm rhel7	exec-maven-plugin	-	-
rpm rhel9	jmc	-	-
rpm rhel7	maven	-	-
rpm rhel7	maven-archiver	-	-

1-10 of 60

Aliases

1. CVE-2025-670302. NVD-2025-670303. OSV-2025-670304. OSV-DEBIAN-2025-670305. GCVE-2025-670306. SECURITY-TRACKER-CVE-2025-67030

References

1. https://github.com/codehaus-plexus/plexus-utils/issues/2942. https://github.com/codehaus-plexus/plexus-utils/pull/2953. https://github.com/codehaus-plexus/plexus-utils/pull/2964. https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b296425. https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec6. https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.