8.8

CVE-2025-67030: codehaus-plexus plexus-utils

Modified
AliasesSUSE-SU-2026:1396-1SUSE-SU-2026:21194-1RHSA-2026:35990
Published 25-03-2026Last modified 16-09-2026

Vulnerability summary

CVE-2025-67030 is a high (CVSS 8.8) vulnerability in codehaus-plexus plexus-utils. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.69%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
RHSA-2026:18054RHSA-2026:18055CGA-7H4Q-9657-Q3XX

Timeline

  1. 25-03-2026
    PublishedVulnerability first disclosed.
  2. 16-09-2026
    Last modifiedVulnerability information updated.

Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.69%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard180 products
  • akhq< 0.27.0-r1
  • apache-camel-karavan-devmode< 4.14.2-r6
  • clojure-tools< 1.12.4.1629-r0
  • confluent-kafka< 8.4.0.11-r0
  • confluent-kafka-jre-bcfips< 8.4.0.11-r0
Wolfi12 products
  • akhq< 0.27.0-r1
  • confluent-kafka< 8.4.0.11-r0
  • dependency-track< 4.14.0-r5
  • dependency-track-bundled< 4.14.0-r5
  • druid< 37.0.0-r0
Opensuse3 products
  • plexus-utils&distro=openSUSE Leap 15.6< 4.0.2-150200.3.14.1
  • plexus-utils&distro=openSUSE Leap 16.0< 4.0.2-160000.3.1
  • plexus-utils&distro=openSUSE Tumbleweed< 4.0.2-2.1
Ubuntu2 products
  • plexus-utilsAll versions (No fix recorded)
  • plexus-utils2All versions (No fix recorded)
Codehaus-plexus1 product
Debian1 product
  • plexus-utils2All versions (No fix recorded)
Org.codehaus.plexus1 product
  • plexus-utils≥ 4.0.0, < 4.0.3 | < 3.6.1

7 vendors · 200 products · Showing 200 of 739

References

60 links
Show all 60 references