Critical Vulnerability in javapackages-tools: Directory Traversal in Plexus-utils
Summary
RLSA-2026:41948: Important: javapackages-tools:201801 security update. Affects ant across 2 version ranges.
< 0:1.10.5-1.module+el8.3.0+74+855e3f5d
< 0:1.10.5-1.module+el8.10.0+2003+8aeac9cb
Fixed in 0:1.10.5-1.module+el8.3.0+74+855e3f5d or 0:1.10.5-1.module+el8.10.0+2003+8aeac9cb, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The javapackages-tools package provides essential macros and scripts for Java packaging, facilitating the building and management of Java applications. It is widely utilized in various Java projects to streamline the packaging process. However, a critical vulnerability has been identified in the Plexus-utils component, which is part of this package, exposing systems to potential directory traversal attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-67030, originates from a flaw in the extractFile method of the Plexus-utils library. This flaw allows an attacker to exploit the package by manipulating file paths, potentially leading to unauthorized access to sensitive files on the server. The ramifications of this vulnerability are severe, as it can enable attackers to read arbitrary files, leading to data breaches and further exploitation of the system. The CVSS score for this vulnerability is 8.3, indicating a high level of risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update ant-
< 0:1.10.5-1.module+el8.3.0+74+855e3f5d0:1.10.5-1.module+el8.3.0+74+855e3f5d -
< 0:1.10.5-1.module+el8.10.0+2003+8aeac9cb0:1.10.5-1.module+el8.10.0+2003+8aeac9cb
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive directories and files on their systems until the packages are updated. This can be done by modifying file permissions and ensuring that only authorized users have access.
Conclusion
The javapackages-tools package has a critical vulnerability that can lead to severe security risks. It is essential to update the affected packages promptly and implement the recommended security measures to protect your systems.
See every vulnerability recorded for ant →
FAQ
CVE-2025-67030 is a vulnerability in the Plexus-utils library that allows for directory traversal attacks, potentially exposing sensitive files on the server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to sensitive files, data breaches, and potential exploitation of the system by attackers.
It is recommended to regularly update your packages, especially when security vulnerabilities are disclosed, to mitigate risks.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for ant.
