Critical Directory Traversal Vulnerability in plexus-utils Package
Summary
ALSA-2026:38514: Important: plexus-utils security update. Affects plexus-utils versions < 3.5.1-9.el10_2. Fixed in 3.5.1-9.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The plexus-utils package is a core component of the Plexus project, which provides a framework for building applications with reusable components. It includes tools for hibernate, form processing, JNDI, internationalization (i18n), and templating with Velocity. The package is designed to facilitate the development of both embedded and full-scale application servers. However, it has been found to contain a significant security vulnerability that could allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability identified as CVE-2025-67030 is a directory traversal issue in the extractFile method of the plexus-utils package. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized file access outside of the intended directory. If exploited, this could result in the exposure of sensitive information or the execution of arbitrary code, posing a serious risk to the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
3.5.1-9.el10_2
This is the first release that contains the fix.
sudo dnf update plexus-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to restrict access to the affected application or limit its exposure to untrusted users until the patch can be applied. Additionally, review and sanitize any user inputs that may be used in file path operations to mitigate the risk of exploitation.
Conclusion
The directory traversal vulnerability in the plexus-utils package poses a significant risk to applications utilizing this library. It is crucial to update to the patched version to safeguard against potential exploitation. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts based on manifest files.
See every vulnerability recorded for plexus-utils →
FAQ
plexus-utils is a library that provides utility functions for the Plexus framework, facilitating application development with reusable components.
The directory traversal vulnerability allows attackers to access files and directories outside the intended directory, potentially leading to unauthorized data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, data breaches, or even arbitrary code execution on the server.
Yes, you can restrict access to the application and sanitize user inputs to reduce the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for plexus-utils.
