Critical Directory Traversal Vulnerability in plexus-utils Package
Summary
RLSA-2026:38514: Important: plexus-utils security update. Affects plexus-utils versions < 0:3.5.1-9.el10_2. Fixed in 0:3.5.1-9.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The plexus-utils package is a core component of the Plexus project, which provides a suite of developer tools for building applications. It includes reusable components for various functionalities such as hibernate, form processing, and internationalization. The package is designed to be embedded in applications or used within a full-scale application server, making it a vital part of many Java-based projects. However, it has been found to contain a critical vulnerability that could allow unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability identified as CVE-2025-67030 is a directory traversal issue in the extractFile method of the plexus-utils package. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized access to sensitive files on the server. The implications of this vulnerability are severe, as it could enable attackers to read or overwrite files outside the intended directory, compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
0:3.5.1-9.el10_2
This is the first release that contains the fix.
sudo dnf update plexus-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict file permissions and validate user inputs to prevent unauthorized file access until the package can be updated. Implementing strict input validation can help mitigate the risk of exploitation.
Conclusion
The plexus-utils package has a critical directory traversal vulnerability (CVE-2025-67030) that poses significant risks to applications using it. Users are urged to update to the latest patched version to ensure their systems remain secure. For those unable to update immediately, implementing workarounds can help reduce the risk of exploitation.
See every vulnerability recorded for plexus-utils →
FAQ
CVE-2025-67030 is a directory traversal vulnerability in the plexus-utils package that allows attackers to access files outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive files, which may compromise the integrity and confidentiality of the system.
Yes, a patched version of the plexus-utils package is available. Users should update to version 0:3.5.1-9.el10_2 or later.
If immediate updates are not possible, implement strict input validation and restrict file permissions to mitigate the risk temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for plexus-utils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
