CVE-2025-67030
Vulnerability Summary
Timeline
Description
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
CVSS Metrics
- v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- v3.1•HIGH•Score: 8.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS Trends
Current EPSS score: 0.66%• Percentile: 50%
Techniques & Countermeasures
- CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected Systems
- chainguard•akhq
< 0.27.0-r1
- chainguard•apache-camel-karavan-devmode
< 4.14.2-r6
- chainguard•clojure-tools
< 1.12.4.1629-r0
- chainguard•confluent-kafka
< 8.4.0.11-r0
- chainguard•confluent-kafka-jre-bcfips
< 8.4.0.11-r0
- chainguard•dependency-track
< 4.14.0-r5
- chainguard•dependency-track-apiserver
< 4.14.0-r1
- chainguard•dependency-track-bundled
< 4.14.0-r5
- chainguard•druid
< 37.0.0-r0
- chainguard•eco-java-gradle-1.11
all
- chainguard•eco-java-gradle-2.0
all
- chainguard•eco-java-gradle-2.1
all
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.2
all
- chainguard•eco-java-gradle-2.2.1
all
- chainguard•eco-java-gradle-2.3
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
Showing first 50 affected entries in server-rendered view.
References (56)
- https://github.com/codehaus-plexus/plexus-utils/pull/295
- https://github.com/codehaus-plexus/plexus-utils/issues/294
- https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
- https://github.com/codehaus-plexus/plexus-utils/pull/296
- https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
- https://nvd.nist.gov/vuln/detail/CVE-2025-67030
- https://github.com/codehaus-plexus/plexus-utils
- https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3
- https://access.redhat.com/security/cve/CVE-2025-67030
- https://bugzilla.redhat.com/show_bug.cgi?id=2451409
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:7109
- https://access.redhat.com/errata/RHSA-2026:7380
- https://access.redhat.com/errata/RHSA-2026:35991
- https://access.redhat.com/errata/RHSA-2026:35996
- https://access.redhat.com/errata/RHSA-2026:35990
- https://access.redhat.com/errata/RHSA-2026:35992
- https://access.redhat.com/errata/RHSA-2026:36012
- https://access.redhat.com/errata/RHSA-2026:35997
- https://access.redhat.com/errata/RHSA-2026:38514
- https://access.redhat.com/errata/RHSA-2026:38796
- https://access.redhat.com/errata/RHSA-2026:38500
- https://access.redhat.com/errata/RHSA-2026:40841
- https://access.redhat.com/errata/RHSA-2026:41948
- https://access.redhat.com/security/updates/classification/#important
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35990.json
- https://www.cve.org/CVERecord?id=CVE-2025-67030
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35991.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35992.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35996.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35997.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36012.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38500.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38514.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38796.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40841.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41948.json
- https://ubuntu.com/security/CVE-2025-67030
- https://security-tracker.debian.org/tracker/CVE-2025-67030
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60239
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60256
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67030.json
- https://access.redhat.com/errata/RHSA-2026:65126