CVE-2025-67030

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67030
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67030.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67030
Aliases
Downstream
AZL (1)
CGA (472)
CLEANSTART (11)
CLSA (31)
DEBIAN (1)
ECHO (1)
MINI (19)
openSUSE (2)
RHSA (13)
RLSA (5)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (5)
openSUSE (2)
SUSE (2)
Published
2026-03-25T00:00:00Z
Modified
2026-09-18T08:14:39Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67030.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "6d780b3378829318ba5c2d29547e0012d5b29642"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/codehaus-plexus/plexus-utils

Affected ranges

Type
GIT
Repo
https://github.com/codehaus-plexus/plexus-utils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c61982e755b021faca509637f1ea6ae04ee241c3
Introduced
0803079106d268c234271ef6ddfce7e35f6def5a
Fixed
c86a34f37425fc5fd698c76241623c8d02dab7c6
Fixed
6d780b3378829318ba5c2d29547e0012d5b29642
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.6.1"
        },
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.0.3"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

plexus-utils-2.*
plexus-utils-2.0.7
plexus-utils-2.1
plexus-utils-3.*
plexus-utils-3.0
plexus-utils-3.0.1
plexus-utils-3.0.10
plexus-utils-3.0.11
plexus-utils-3.0.12
plexus-utils-3.0.13
plexus-utils-3.0.14
plexus-utils-3.0.15
plexus-utils-3.0.16
plexus-utils-3.0.17
plexus-utils-3.0.18
plexus-utils-3.0.19
plexus-utils-3.0.2
plexus-utils-3.0.20
plexus-utils-3.0.21
plexus-utils-3.0.22
plexus-utils-3.0.23
plexus-utils-3.0.24
plexus-utils-3.0.3
plexus-utils-3.0.4
plexus-utils-3.0.5
plexus-utils-3.0.6
plexus-utils-3.0.7
plexus-utils-3.0.8
plexus-utils-3.0.9
plexus-utils-3.1.0
plexus-utils-3.1.1
plexus-utils-3.2.0
plexus-utils-3.2.1
plexus-utils-3.3.0
plexus-utils-3.4.0
plexus-utils-3.4.1
plexus-utils-3.4.2
plexus-utils-3.5.0
plexus-utils-3.5.1
plexus-utils-3.6.0
plexus-utils-4.*
plexus-utils-4.0.0
plexus-utils-4.0.1
plexus-utils-4.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67030.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "131354540315363801261637833377078918654",
                "338334584729236094926190125453864073140",
                "281835779799960053543877750652403097703",
                "114046258734544777119679608583605122497",
                "299044606453861992357501986191179037148"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-67030-6101b9d5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
        "target":  {
            "file":  "src/main/java/org/codehaus/plexus/util/Expand.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "97577865499434748473689265218962043804",
            "length":  919
        },
        "id":  "CVE-2025-67030-da63071b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
        "target":  {
            "file":  "src/main/java/org/codehaus/plexus/util/Expand.java",
            "function":  "extractFile"
        }
    }
]
vanir_signatures_modified 
"2026-09-18T08:14:39Z"