VIR Vulnerability Intelligence Relay

CVE-2025-67030

high
Published 2026-03-25 · Modified 2026-04-08
CVSS v3
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2
—
VIR risk
8.8

Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-67030

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-67030.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/codehaus-plexus/plexus-utils/pull/296

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/codehaus-plexus/plexus-utils/pull/295

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidaffected
debian debiantrixieaffected

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.codehaus.plexus:plexus-utils>=4.0.0,<4.0.34.0.3
java Mavenorg.codehaus.plexus:plexus-utils<3.6.13.6.1

Application impact
VendorProductVersionsFixed
codehaus-plexusplexus-utils{"endExcluding":"3.6.1"}3.6.1

References

CWEs

CWE-22

Verify integrity in audit chain (admin only). AS-IS.