CVE-2025-67030: Plexus-Utils Directory Traversal Vulnerability in extractFile Method
Summary
CVE-2025-67030: Plexus-Utils has a Directory Traversal vulnerability in its extractFile method. Affects org.codehaus.plexus:plexus-utils versions < 4.0.3. Fixed in 4.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plexus-Utils is a utility library used in various Java applications, providing essential functions for file manipulation, including extraction and expansion of archives. The library is widely utilized in Maven projects, making it a critical component for developers. However, a vulnerability in its extractFile method has been identified, which could allow unauthorized access to the file system.
Vulnerability Detail
The Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils versions prior to 4.0.3 allows attackers to manipulate file paths. By exploiting this flaw, an attacker can potentially execute arbitrary code on the server, leading to severe security breaches. This vulnerability is classified under CWE-22, indicating its nature of allowing unauthorized file access.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the extractFile method for untrusted input. Implement strict validation of file paths to prevent directory traversal attacks. Additionally, consider using alternative libraries that do not exhibit this vulnerability.
Conclusion
The Plexus-Utils library has a critical Directory Traversal vulnerability that can lead to severe security issues. It is essential to update to the patched version 4.0.3 or later to mitigate risks. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can help you stay informed about potential threats.
See every vulnerability recorded for org.codehaus.plexus:plexus-utils →
FAQ
The vulnerability can lead to unauthorized file access and execution of arbitrary code, posing a significant security risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of plexus-utils prior to 4.0.3 are affected by this vulnerability.
Yes, the patch is available in version 4.0.3 and later of plexus-utils.
If an immediate update is not possible, implement strict input validation and avoid using the vulnerable method until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.plexus:plexus-utils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
