Critical Directory Traversal Vulnerability in plexus-utils Package
Summary
RLSA-2026:38796: Important: plexus-utils security update. Affects plexus-utils versions < 0:3.3.0-14.el9_8. Fixed in 0:3.3.0-14.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The plexus-utils package is a core component of the Plexus project, which provides a suite of developer tools for building applications. It includes reusable components for various functionalities such as Hibernate, form processing, JNDI, internationalization (i18n), and templating with Velocity. The package is designed to be lightweight and can be embedded in applications or used within a full-scale application server. However, it has been identified to have a critical security vulnerability that could potentially allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability, identified as CVE-2025-67030, is a directory traversal issue in the extractFile method of the plexus-utils package. This flaw allows an attacker to manipulate file paths and access files outside of the intended directory structure. If exploited, this could lead to unauthorized disclosure of sensitive information or even complete system compromise. The vulnerability has been assigned a CVSS score of 8.3, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.3.0-14.el9_8
This is the first release that contains the fix.
sudo dnf update plexus-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the directories that may be affected by this vulnerability, ensuring that only authorized users have the necessary permissions to access sensitive files. However, this is not a substitute for applying the patch.
Conclusion
The plexus-utils package has a critical directory traversal vulnerability that poses significant risks to applications using it. Users are strongly advised to update to the latest patched version to safeguard their systems. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for plexus-utils →
FAQ
The plexus-utils package is a set of utilities for the Plexus project, which provides tools for application development, including components for various functionalities like Hibernate and form processing.
The directory traversal vulnerability allows attackers to manipulate file paths, potentially gaining unauthorized access to files outside the intended directory structure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement access restrictions on sensitive directories as a temporary workaround until the patch can be applied.
More information about the CVE-2025-67030 can be found on the official CVE page, which provides detailed insights into the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for plexus-utils.
