HIGH

GHSA-6fmv-xxpf-w3cw

Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

Quick fix

GHSA-6fmv-xxpf-w3cw — org.codehaus.plexus:plexus-utils: upgrade to the fixed version with the command below.

# pom.xml: bump <version>4.0.3</version> for org.codehaus.plexus:plexus-utils

Details

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.codehaus.plexus:plexus-utils

Introduced in: 4.0.0Fixed in: 4.0.3

Fix# pom.xml: bump <version>4.0.3</version> for org.codehaus.plexus:plexus-utils

Maven/org.codehaus.plexus:plexus-utils

Introduced in: 0Fixed in: 3.6.1

Fix# pom.xml: bump <version>3.6.1</version> for org.codehaus.plexus:plexus-utils

References

https://nvd.nist.gov/vuln/detail/CVE-2025-67030[ADVISORY]
https://github.com/codehaus-plexus/plexus-utils/issues/294[WEB]
https://github.com/codehaus-plexus/plexus-utils/pull/295[WEB]
https://github.com/codehaus-plexus/plexus-utils/pull/296[WEB]
https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642[WEB]
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec[WEB]
https://github.com/codehaus-plexus/plexus-utils[PACKAGE]
https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3[WEB]