--- id: CVE-2025-67030 title: >- Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642 summary: >- Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-22 vendor: codehaus-plexus product: plexus-utils affected: - plexus-utils < 3.6.1 - 'plexus-utils >= 4.0.0, < 4.0.3' patched: - plexus-utils 4.0.3 published: '2026-03-25' updated: '2026-09-16' sourceUpdated: '2026-09-16T13:17:17.453' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67030' references: - url: 'https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec' label: cve@mitre.org - url: >- https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 label: cve@mitre.org - url: 'https://github.com/codehaus-plexus/plexus-utils/issues/294' label: cve@mitre.org - url: 'https://github.com/codehaus-plexus/plexus-utils/pull/295' label: cve@mitre.org - url: 'https://github.com/codehaus-plexus/plexus-utils/pull/296' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2026:17668' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18054' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18055' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18059' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:35990' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:35991' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:35992' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:35996' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:35997' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36012' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:38500' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:38514' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:38796' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40841' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41948' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60239' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60246' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60247' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60248' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60249' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60250' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60251' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60252' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60254' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60256' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60259' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65126' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7109' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7380' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2025-67030' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451409' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2025-67030' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67030' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00663 epssPercentile: 0.49501 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-03-27T19:33:16.549505Z' scores: nvd: 8.8 vendor: 8.3 adp: 8.8 ingestedAt: '2026-07-07T12:52:59.554Z' --- ## Overview Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code ## Affected - `plexus-utils < 3.6.1` - `plexus-utils >= 4.0.0, < 4.0.3` ## Remediation Upgrade past the affected range: - `plexus-utils 4.0.3` ## Vendor advisories - **RHSA-2026:18054** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18054) - **RHSA-2026:18055** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18055) - **RHSA-2026:35991** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35991) - **RHSA-2026:38514** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38514) - **RHSA-2026:40841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40841) - **RHSA-2026:35996** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35996) - **RHSA-2026:35990** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35990) - **RHSA-2026:35992** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35992) - **RHSA-2026:36012** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:36012) - **RHSA-2026:35997** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35997) - **RHSA-2026:38500** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38500) - **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Data Grid 8, … · no fix planned: OpenShift Serverless, Red Hat build of Debezium 3, Red Hat Data Grid 8, Red Hat Enterprise Linux 6, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json)