CVE-2025-70952: pf4j_project pf4j Path Traversal
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-70952DEBIAN-CVE-2025-70952CGA-v5c6-rmqh-8gr8CGA-xj2v-xjgx-mmj6CGA-22rc-c4j4-cx36CGA-2pq2-vrrv-v4x9CGA-3hcm-4pv4-j3q7CGA-4rg5-9vgp-c53mCGA-6f4q-j648-fv7gCGA-78vh-w6cw-774vCGA-7vhj-rpq4-5p8gCGA-85jc-fjw8-4ccvCGA-97qh-6496-36vcCGA-9rpv-8rjr-rjmxCGA-f82q-r64q-8f74CGA-g2w9-3x3r-g8g6CGA-gjrp-8248-67hvCGA-hm7v-5pm8-xvcfCGA-jrmr-pphj-3fp5CGA-mr89-pmm7-cr22GHSA-5458-7hh9-v7p4CGA-v5pf-h327-7fpgCGA-vc9g-8rgw-qr59CGA-w9hg-q2j2-3mfgCGA-x28r-pjwx-rqrm
Published 25-03-2026Last modified 28-03-2026
Vulnerability summary
CVE-2025-70952 is a high (CVSS 7.5) Path Traversal vulnerability in pf4j_project pf4j. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.86%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 28-03-2026Last modifiedVulnerability information updated.
Description
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
CVSS metrics
7 scores · 7 sources · 2 versionsHigh 8.7Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.86% on 20-09-2026
20-09-202620-10-2026
EPSS score0.86%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPf4J
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- kayenta-2025.0< 2025.0.8-r10
- kayenta-2025.1< 2025.1.6-r8
- kayenta-2025.2< 2025.2.4-r4
- kayenta-2025.4< 2025.4.3-r5
- kayenta-2026.0< 2026.0.2-r5
Ubuntu2 products
- libpf4j-javaAll versions (No fix recorded)
- libpf4j-update-javaAll versions (No fix recorded)
Debian1 product
- libpf4j-javaAll versions (No fix recorded) | < 3.15.0+dfsg-1
Org.pf4j1 product
- pf4j< 3.14.1
Pf4j_project1 product
- pf4j< 3.14.1
Wolfi1 product
- nextflow< 25.10.4-r2
6 vendors · 17 products
References
10 links
- github.com/pf4j/pf4jPACKAGE