CVE-2025-67030

Aliases:GHSA-6fmv-xxpf-w3cwRHSA-2026:35990RHSA-2026:35991RHSA-2026:35992RHSA-2026:35996RHSA-2026:35997RHSA-2026:36012RHSA-2026:38500RHSA-2026:38514RHSA-2026:38796RHSA-2026:40841RHSA-2026:41948UBUNTU-CVE-2025-67030DEBIAN-CVE-2025-67030CGA-24ww-5gpc-vvjfCGA-2cpj-qm3m-qm89CGA-2mwf-5fc8-c393CGA-2x3w-3w5r-rp46CGA-3c7c-jj9j-4f23CGA-4r68-mqrr-83vxCGA-4v6p-78cq-j93mCGA-4vr7-2wvq-m8fcCGA-68cj-2446-r875CGA-6qj2-qrv6-3q6cCGA-9476-36cx-m37hCGA-988q-jmmq-vhqgCGA-9gq5-rmm9-vr7gCGA-c9mp-9hxf-wjchCGA-gjqr-wq2f-5mjvCGA-h76h-xvjx-3gg3CGA-hmqj-5gp3-jrvjCGA-hw76-f352-j9vjCGA-m59f-2rxc-gww8CGA-mq2v-wr4j-qcmrCGA-23j8-87vm-82w4CGA-25rg-wpqj-pggwCGA-29f5-cwjv-j955CGA-322r-7m2g-f2fvCGA-34c3-jrh4-v7f4CGA-34ww-jc95-jjm5CGA-35wm-3r3q-3mc9CGA-3f3m-6wcg-gj6jCGA-3g99-xxmf-5vrfCGA-3j7m-m86p-qq4hCGA-3mf2-342w-wpv2CGA-3rp2-m4ph-f6p7CGA-3vv6-v7fq-pc8gCGA-4352-qj3p-8qr8CGA-44wf-4cq9-qghqCGA-459m-w99r-557mCGA-4646-cc9j-pq9fCGA-467j-h4wm-cmjwCGA-4ggg-9hrx-v7q7CGA-4j8g-x57f-j6f8CGA-53q4-5fqq-q8mxCGA-54gq-rrfx-x42rCGA-57h6-7fjm-3hc9CGA-5gj2-qpxf-rgj7CGA-5gwx-jhr4-39x8CGA-5p2p-x9gx-j83gCGA-5p2x-mjpf-f56hCGA-5ppf-f428-c25cCGA-5x25-ppwm-w6wrCGA-6395-w48h-6pvjCGA-63rc-6vm9-833fCGA-663j-mcv6-54w6CGA-6838-c85p-crm3CGA-689h-344c-qrqfCGA-68fg-gp66-2ppmCGA-6gvg-fw94-j98cCGA-6jj4-p99p-g6q8CGA-6m83-pxgf-jwchCGA-6pxr-fvww-xqq3CGA-6vhg-xw8c-r29cCGA-6xf3-7xgc-wjrfCGA-732v-83rh-rp6fCGA-733g-25cq-hp78CGA-73j3-rpc2-7v4vCGA-73r4-7gqg-pgcfCGA-7647-j429-3xg5CGA-7733-j949-49rrCGA-776j-m7r8-qg34CGA-78p3-r7v9-45x4CGA-798v-2pv9-69pfCGA-7c23-gg34-m49fCGA-7fc4-rvg6-xcgpCGA-7g6f-4c3p-qhq6CGA-7h86-26gv-4428CGA-7vrx-w8v3-xgqvCGA-7x5f-rgcv-hcg8CGA-822q-rgq6-2ffjCGA-82vg-jvrr-537wCGA-835v-3fq7-2g26CGA-84fh-xjg6-rmp5CGA-84g7-52p4-7v3mCGA-859x-v7rm-f2qpCGA-864r-7jvv-8hf3CGA-87h3-9pr8-vfqvCGA-8c9x-59jv-p87wCGA-8h3q-rxvq-983mCGA-8jvw-fqj9-6x2rCGA-8mh5-5533-rq6cCGA-8qr2-qfq3-2rpvCGA-8rqw-jw99-ppcxCGA-8w9c-pc58-9wr8CGA-92j8-wjvw-4928CGA-92wf-rvwr-49g4CGA-9382-cg3p-8g8jCGA-966j-5x48-pj6qCGA-977v-j63w-vq6pCGA-97q2-wg95-6rffCGA-98xj-j94j-5q74CGA-9fp6-v53p-mjpjCGA-9g7q-p58f-9vx7CGA-9gp2-j5gg-rv88CGA-9m4f-cj7w-rp66CGA-9p95-5f6q-m292CGA-9qvf-c2w9-gwhjCGA-9wgh-93j6-2rq8CGA-9x5h-vh8w-rjwgCGA-9xpm-4pq4-wjmxCGA-c692-xcp8-37h8CGA-c7g5-pjww-8v34CGA-c8pv-fw6h-66q6CGA-cf93-j5hp-x7qxCGA-cgjw-rh36-84mjCGA-cjc6-ggg4-rfhrCGA-cr3f-9fjj-rjr4CGA-crhg-f4pf-7xqhCGA-cw4g-qww8-659xCGA-f39q-w48q-7gmcCGA-f6m5-84cv-hp4jCGA-fffg-fh5q-9g7rCGA-fg8w-g73x-crfwCGA-fjfv-44g7-h4x3CGA-fm84-wgv7-2xj3CGA-fm84-xwrh-f7vpCGA-fqj3-w78p-339fCGA-fqp9-whqx-95wgCGA-frfv-gj3q-hj63CGA-g23g-5cjj-xmpfCGA-g548-x4c8-mh94CGA-g5p3-494x-pj7vCGA-gcvv-fwg4-mf74CGA-gffh-jpmf-9678CGA-gfpq-mcpc-2g5xCGA-gfpw-m8j3-8v8vCGA-gg8g-w487-v3cqCGA-gh56-mfr4-xp6gCGA-gj77-6jg3-344pCGA-gpgm-jfqv-jrq3CGA-gqcj-cjvh-hww2CGA-gqqj-r36v-8wp9CGA-h44j-9j9j-crx3CGA-h473-mjr8-q477CGA-h5j6-3v8p-2jr4CGA-h6vq-7m9m-4h8mCGA-h9j4-rjv7-jrmmCGA-hhhc-43vv-76qpCGA-hpp6-xpq2-4gc5CGA-hw4q-wgr6-c4j4CGA-j4fr-9v74-8pq6CGA-j5rv-9fxq-p9q5CGA-j645-62h3-3qh8CGA-j755-fgpm-83c5CGA-jh9v-2rh9-5787CGA-jw64-3pwf-v7gmCGA-jx65-g642-ppp5CGA-m325-jf47-5hvcCGA-m5c4-9496-8j9qCGA-m784-7c4f-5p4xCGA-mc88-8mp2-xgw9CGA-mf68-cw8f-3fj3CGA-mg33-p26f-r436CGA-mhmm-pccg-w8xmCGA-mjgh-qvm2-3whqCGA-mq3f-r4w8-55vjCGA-mq74-x6hx-x5m4CGA-mw82-8jjc-r83xCGA-mwm2-69f2-2385CGA-mx35-74vx-8mhcCGA-p2wg-c5c8-gx7pCGA-pf95-7mpm-m552CGA-pgcc-2765-gh6gCGA-pgg6-3hj3-4h8jCGA-pwh8-9w5g-84j6CGA-pxm9-27cm-7f54CGA-q4vp-2ghm-c55gCGA-q5cp-pmf8-rgvrCGA-q5w7-mgmq-j7m7CGA-q6cj-chmv-r7qwCGA-q7jr-cf96-mc96CGA-qfxv-qjgm-m2rjCGA-qhmq-66h6-r65jCGA-qj8w-77cx-fq7fCGA-qp36-fgg8-9442CGA-qr92-72hc-4j5rCGA-qrp4-3c3x-2jgpCGA-qvrm-9vcr-8734CGA-qx49-2m72-cxx3CGA-qx73-r5ph-9xh3CGA-r3m7-mrr4-p5qxCGA-r3r6-49wv-jq93CGA-r5hf-rjrr-292gCGA-r5hp-v33g-xwjpCGA-r772-m7g9-m65qCGA-rc3x-8j6x-fj2gCGA-rf9q-ffj2-wg5fCGA-rfj3-7hxw-h872CGA-rgcf-vmvc-h7jrCGA-rh4m-8rrx-vjr7CGA-rmrp-2q3q-95vfCGA-rp9f-64q6-fg66CGA-rph7-v5jf-j675CGA-v44w-9g26-827wCGA-v68q-4492-rg3jCGA-vf53-mxcj-ppgmCGA-vfp2-w5q7-7pc7CGA-vfxx-f96h-gq83CGA-vm9c-cc6x-33rhCGA-vpxr-43qc-cmf9CGA-vq4c-fqm8-78j6CGA-vq4c-hvj8-j5hcCGA-w3mc-hcg8-6mj6CGA-w45q-4mp9-cj3fCGA-w584-p939-m28hCGA-w59f-9wgx-2pgxCGA-w95c-gp86-j65vCGA-wcmg-pjxj-cxgwCGA-wggr-8v44-7w54CGA-wh92-85pc-6g6cCGA-whc9-7r46-wwvpCGA-whgf-mj4q-rq66CGA-wmqh-9j8v-pq4mCGA-wmwx-h5vj-4r78CGA-wq4c-g59q-c37qCGA-ww7p-8225-m24pCGA-x22g-6c67-xpprCGA-x3wf-g7gh-jr6vCGA-x64h-hp3j-mf3gCGA-x6mr-vwmj-ff55CGA-x6rg-438p-qm7hCGA-x7x5-46g3-vmqxCGA-x8p8-6283-9p6qCGA-x994-cvr4-83w3CGA-x9vx-9gmx-xf47CGA-xfmw-phj7-29h8CGA-xmr5-554p-35ghCGA-xqvh-r939-gw7xCGA-xxjj-gqpp-898mCGA-24pg-c44q-w2rrCGA-2g7c-67qp-j28fCGA-3wcr-jv93-4g3mCGA-4cj2-q4pf-376xCGA-4rr3-hj6w-h4pqCGA-53xp-94wf-hh32CGA-59cf-9rhr-j57hCGA-5cm3-8fqw-p3m6CGA-5rrp-53j4-86v4CGA-69m6-rq9q-ch55CGA-6mp5-cjvp-4ghcCGA-7h28-pf2q-hv9vCGA-8495-58wg-4wfpCGA-85mq-f548-6ww8CGA-9345-rvpc-r73gCGA-99q4-c4pj-wj8wCGA-cghh-3hv5-8h72CGA-cj86-qm35-2mf6CGA-cv52-5w43-pf45CGA-ffgg-vjrf-m294CGA-g25h-hr73-7xmxCGA-g2qj-7872-3vqpCGA-g62r-xh7j-3xgjCGA-gch8-4v57-x6rxCGA-grff-f5w6-r6g6CGA-h542-xh9r-2wv4CGA-h96q-qv34-c8jrCGA-hhcg-q5v6-v92rCGA-hwxr-fhfp-c52gCGA-jh6p-c7gx-mmh9CGA-jvr4-r958-f536CGA-m67q-gp62-8cpgCGA-mp2v-qc7f-hgr2CGA-mq5c-w8rc-g6vmCGA-mx7g-5fcc-566gCGA-p3c3-p4cf-ff7xCGA-pjxh-qcv9-qp72CGA-pp82-m4xr-9cq5CGA-qqfx-rm36-cc7pCGA-qv4w-vjgr-prqqCGA-r4vw-ph89-h2c7CGA-r8p3-hm46-m379CGA-rmhm-mp7c-fq8jCGA-rvrg-64m4-hmwfCGA-rw99-h64p-hmm3CGA-v6hg-qv86-crhwCGA-vfgv-634x-4r2mCGA-x9fq-7m45-fhh4CGA-xpr8-pqqp-6ggvCGA-xvxj-v27g-2jpwCGA-xw5g-mr55-59mxCGA-xxvv-j28g-xhcwCGA-228v-4863-cm45CGA-25g2-hj83-prg2CGA-26pq-xpjh-w75fCGA-2gq5-p7cc-fj2pCGA-2h7w-q47h-x453CGA-38rf-9pmr-2mqxCGA-3f2m-rrxh-qqrwCGA-3jgg-qgrc-565qCGA-3x3p-rc34-688mCGA-4g53-vfxc-f3pmCGA-4g5w-wv94-3gwpCGA-4q74-7976-q5vwCGA-4rjh-9f5f-x3hjCGA-4v5f-h98g-244fCGA-4xvg-rpg7-hwgwCGA-644j-7fph-v8gmCGA-6cpr-r8wq-jw7qCGA-6h29-3pr3-94w8CGA-6v27-65c8-322vCGA-6vch-7f5r-3gh6CGA-72h3-87v2-p9g4CGA-76p5-9chf-882wCGA-777x-m5mq-fjvwCGA-7m7v-988j-c9r6CGA-83qx-8278-6g44CGA-87v7-5746-9r78CGA-892x-wp3p-hjhxCGA-89m2-6xv9-gx32CGA-8g8j-p2f5-xhcwCGA-8j25-78wh-3wvfCGA-8mp9-phmc-8xcgCGA-8mv9-mpmw-fcc7CGA-8r3c-r8jm-r7p4CGA-8v7g-6qhm-96r2CGA-9j83-jjff-6hj6CGA-9m3r-526c-rwp9CGA-9qw9-pwpv-c4c7CGA-9w42-qpq4-r8wmCGA-9w5m-qgg3-4mm3CGA-cc38-9rr7-fmc7CGA-cf6c-77r2-8rhgCGA-f35g-xpxm-w7w9CGA-fhcp-7cf4-69x6CGA-fmrm-m3h2-hp2gCGA-fp5v-jg8h-fgp5CGA-g7x2-67wh-jh86CGA-g9qp-g485-7x34CGA-gjqf-6473-2wj7CGA-grr3-34gp-q9cxCGA-h5f3-g2v7-xxr3CGA-h89w-8cwc-h994CGA-h8gj-vh84-25gfCGA-h8q2-g5m7-hqwvCGA-hg5r-gvqp-35j4CGA-hg6v-x3h8-r8f5CGA-hm7x-x39c-4ggqCGA-hx9j-43q7-v4vpCGA-hxrj-759f-p3gwCGA-j8j7-2cv8-wx27CGA-jmjx-9wpj-82g8CGA-jrg3-7pgm-258mCGA-jv54-836j-2245CGA-m63r-8rxh-j36qCGA-m74w-ffpp-6p4wCGA-m8g8-3fgx-2vgrCGA-m9xx-mjmp-rjvwCGA-mcpr-vrww-r5whCGA-mhvp-gx54-3q7cCGA-mmx6-rp68-cwxrCGA-mq5j-pjgm-5h43CGA-mvw6-h7hh-x24vCGA-p33f-cmgp-pf74CGA-p7j5-m79h-cvf4CGA-pr73-fvmq-fpfmCGA-qqm8-m887-g6gqCGA-qrg7-8m62-f6rgCGA-qvff-pv2q-998cCGA-r53r-j84f-gpf3CGA-r6q3-qmv5-65mgCGA-rh53-77j7-2vv4CGA-rqx9-9967-pwhmCGA-rx4p-7rm8-65mhCGA-v255-w7qm-94vfCGA-v42h-w49m-8p25CGA-vjh5-24xg-85r7CGA-vw9r-4pmc-rx6wCGA-w62v-w5jh-v7phCGA-wcwx-58c3-76rcCGA-wjpw-jj8v-wjp5CGA-wm3x-wv3q-w7hqCGA-wm72-vvjc-w88gCGA-wmj6-m728-f8rhCGA-wrf3-2wj9-2gjrCGA-x3qg-37xf-qxf4CGA-x4x4-v6m7-pj72CGA-xc5w-q7hx-r54jCGA-xf2r-gjx2-ppqqCGA-xq22-vj4f-9vm4CGA-xqv6-gxgj-3x3xCGA-273j-rpx4-95rfCGA-29wf-g84p-g8xjCGA-2vqp-3wpw-h92xCGA-2vrg-7rwf-8jfgCGA-32g6-6rj9-hx7fCGA-357w-fcv7-vhr7CGA-36m6-vg4w-m7mmCGA-3892-4vqv-vmm9CGA-39mr-g6pq-qrqgCGA-3ch6-39cr-pr5wCGA-3g56-g4gw-vmfrCGA-3q3h-59wr-qwfqCGA-3qx2-6c34-rjq6CGA-426g-q766-v7r9CGA-44pc-6r9q-m25cCGA-4674-x9j6-gf49CGA-4c6f-6j53-6g4cCGA-4g4f-887c-qh6xCGA-5w29-r2ff-cqx2CGA-6234-r9jv-w6w6CGA-68p2-qv64-6f6wCGA-7223-j4vp-3p93CGA-748v-rfv4-3v7vCGA-798v-wcp4-cxqfCGA-7jw6-m76p-f7cvCGA-8p39-8pf5-mmxjCGA-93jh-w8h6-qxr4CGA-9cxc-x8f8-frrrCGA-9hm9-7c5w-fwxvCGA-9q92-247w-fm9xCGA-c452-fff6-6pg8CGA-c4q8-m48h-vv78CGA-c5jr-466w-mh7gCGA-c5mv-q2mq-wwh3CGA-cj5g-8qhm-5qq2CGA-cpp4-5qx3-vv5fCGA-cqhj-7m5r-hr2rCGA-f7cp-98g4-6vwhCGA-f88x-xfmm-3hqwCGA-f89x-4hr6-g9rcCGA-fg55-6jxw-r4m4CGA-g5hf-qfvj-p4fwCGA-ggcr-g5gv-7jm5CGA-ghvv-4mpf-xp67CGA-h3r4-63q7-5gq2CGA-h5rr-78px-mpg9CGA-h6gh-9rww-cq5vCGA-hc5h-j8c3-wwvfCGA-jq3g-47v7-cmp7CGA-jr3g-34cw-x3c8CGA-m2qr-mv4q-cjj7CGA-m4cp-4g75-m6qvCGA-m5qr-6q2m-34jrCGA-m6qx-7q2r-4xcgCGA-m7c6-9862-358mCGA-mf25-xh3w-fw8qCGA-mjfx-j37p-45p6CGA-mr68-79p8-v467CGA-mx2f-j8vc-c2h5CGA-p2fq-gpvf-p62hCGA-p694-37x8-h9v9CGA-pccv-xpm4-mg32CGA-pgr4-pqvp-2qg6CGA-pmrg-3ccw-wjmwCGA-pvpm-phr7-5vf3CGA-pw2r-g4x7-7rxcCGA-pxgq-x3g6-wh5qCGA-q8mp-crr9-qcgwCGA-qhcc-fm6f-j4grCGA-r3xc-gmr5-jhg4CGA-r5hp-fjqc-4g95CGA-r8jv-3gmw-mfwxCGA-rhc3-5398-45vcCGA-v4h4-rq79-g657CGA-vf4j-jw99-96j8CGA-vxhp-m638-9fqrCGA-w9wx-3rw8-hcrrCGA-wfqw-vx2f-hpfcCGA-whgq-37r2-6f79CGA-wjgj-c599-9gf4CGA-x8jh-58pm-9gmgCGA-xcrw-c8x4-m22vCGA-xp68-wq63-j442CGA-xv94-7phj-pmx8CGA-xxp4-286r-vj98
Modified
Published: 25 Mar 2026, 00:00
Last modified:16 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
0.66% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Mar 2026, 00:00
Published
Vulnerability first disclosed
16 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

CVSS Metrics

  • v3.1HIGHScore: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v3.1HIGHScore: 8.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.66% Percentile: 50%

Techniques & Countermeasures

  • CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Systems

  • chainguardakhq

    < 0.27.0-r1

  • chainguardapache-camel-karavan-devmode

    < 4.14.2-r6

  • chainguardclojure-tools

    < 1.12.4.1629-r0

  • chainguardconfluent-kafka

    < 8.4.0.11-r0

  • chainguardconfluent-kafka-jre-bcfips

    < 8.4.0.11-r0

  • chainguarddependency-track

    < 4.14.0-r5

  • chainguarddependency-track-apiserver

    < 4.14.0-r1

  • chainguarddependency-track-bundled

    < 4.14.0-r5

  • chainguarddruid

    < 37.0.0-r0

  • chainguardeco-java-gradle-1.11

    all

  • chainguardeco-java-gradle-2.0

    all

  • chainguardeco-java-gradle-2.1

    all

  • chainguardeco-java-gradle-2.10

    all

  • chainguardeco-java-gradle-2.11

    all

  • chainguardeco-java-gradle-2.12

    all

  • chainguardeco-java-gradle-2.13

    all

  • chainguardeco-java-gradle-2.14

    all

  • chainguardeco-java-gradle-2.14.1

    all

  • chainguardeco-java-gradle-2.2

    all

  • chainguardeco-java-gradle-2.2.1

    all

  • chainguardeco-java-gradle-2.3

    all

  • chainguardeco-java-gradle-2.4

    all

  • chainguardeco-java-gradle-2.5

    all

  • chainguardeco-java-gradle-2.6

    all

  • chainguardeco-java-gradle-2.7

    all

  • chainguardeco-java-gradle-2.8

    all

  • chainguardeco-java-gradle-2.9

    all

  • chainguardeco-java-gradle-3.0

    all

  • chainguardeco-java-gradle-3.1

    all

  • chainguardeco-java-gradle-3.2

    all

  • chainguardeco-java-gradle-3.2.1

    all

  • chainguardeco-java-gradle-3.3

    all

  • chainguardeco-java-gradle-3.4

    all

  • chainguardeco-java-gradle-3.4.1

    all

  • chainguardeco-java-gradle-3.5

    all

  • chainguardeco-java-gradle-3.5.1

    all

  • chainguardeco-java-gradle-4.0

    all

  • chainguardeco-java-gradle-4.0.1

    all

  • chainguardeco-java-gradle-4.0.2

    all

  • chainguardeco-java-gradle-4.1

    all

  • chainguardeco-java-gradle-4.10

    all

  • chainguardeco-java-gradle-4.10.1

    all

  • chainguardeco-java-gradle-4.10.2

    all

  • chainguardeco-java-gradle-4.10.3

    all

  • chainguardeco-java-gradle-4.2

    all

  • chainguardeco-java-gradle-4.2.1

    all

  • chainguardeco-java-gradle-4.3

    all

  • chainguardeco-java-gradle-4.3.1

    all

  • chainguardeco-java-gradle-4.4

    all

  • chainguardeco-java-gradle-4.4.1

    all

Showing first 50 affected entries in server-rendered view.

References (56)