CVE-2025-67030: Plexus Utils Path Traversal Vulnerability

CVE-2025-67030 Overview

CVE-2025-67030 is a Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils. This vulnerability exists in versions prior to commit 6d780b3378829318ba5c2d29547e0012d5b29642. When exploited, this flaw allows an attacker to execute arbitrary code by crafting malicious archive files that can write files outside of the intended extraction directory.

Critical Impact
This vulnerability enables arbitrary code execution through path traversal during archive extraction, potentially allowing attackers to overwrite critical system files or plant malicious executables in sensitive locations.

Affected Products

plexus-utils versions prior to commit 6d780b3378829318ba5c2d29547e0012d5b29642
Applications utilizing the org.codehaus.plexus.util.Expand class for archive extraction
Maven-based build systems that depend on vulnerable plexus-utils versions

Discovery Timeline

2026-03-25 - CVE-2025-67030 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-67030

Vulnerability Analysis

The vulnerability resides in the extractFile method within the org.codehaus.plexus.util.Expand class of the plexus-utils library. This method is responsible for extracting files from archive formats but fails to properly validate and sanitize file paths contained within the archive. When processing archive entries, the method does not adequately check for directory traversal sequences such as ../ in file names.

This oversight allows a maliciously crafted archive to contain entries with path traversal sequences that, when extracted, write files to arbitrary locations on the filesystem outside of the intended destination directory. This classic "Zip Slip" style vulnerability is particularly dangerous in build systems and automated pipelines where archives from untrusted sources may be processed.

Root Cause

The root cause of this vulnerability is insufficient input validation in the extractFile method. The method accepts file paths from archive entries without properly canonicalizing or validating that the resulting extraction path remains within the designated target directory. The absence of path normalization checks allows relative path sequences to escape the extraction directory boundary.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious archive file (such as ZIP, TAR, or JAR) containing entries with directory traversal sequences in their file names. When a vulnerable application processes this archive using the affected extractFile method, files are written to locations outside the intended extraction directory. This can lead to:

Overwriting configuration files to modify application behavior
Placing malicious executables in startup directories for persistent access
Overwriting scripts or binaries that are subsequently executed with elevated privileges
Writing web shells to accessible web directories

The attack requires the victim to extract a malicious archive, which can be achieved through supply chain attacks, compromised dependencies, or social engineering.

Detection Methods for CVE-2025-67030

Indicators of Compromise

Presence of files in unexpected locations following archive extraction operations
Archive files containing entries with ../ or similar path traversal sequences
Unexpected file modifications in directories outside of normal extraction targets
Log entries indicating file operations in sensitive system directories during archive processing

Detection Strategies

Implement file integrity monitoring on critical system directories and configuration files
Monitor archive extraction operations for attempts to write outside designated directories
Scan incoming archive files for entries containing path traversal sequences before processing
Deploy application security monitoring to detect anomalous file system operations

Monitoring Recommendations

Enable detailed logging for all archive extraction operations in applications using plexus-utils
Configure security information and event management (SIEM) rules to alert on path traversal patterns
Implement behavioral analysis to detect unexpected file write operations during build processes
Monitor Maven build logs for unusual extraction activities or file placement warnings

How to Mitigate CVE-2025-67030

Immediate Actions Required

Update plexus-utils to a version containing commit 6d780b3378829318ba5c2d29547e0012d5b29642 or later
Audit applications and build systems for usage of the vulnerable org.codehaus.plexus.util.Expand class
Implement input validation for archive extraction operations as an additional defense layer
Review recent archive processing activities for signs of exploitation

Patch Information

The vulnerability has been addressed in the plexus-utils repository. The fix is available in commit 6d780b3378829318ba5c2d29547e0012d5b29642. Organizations should update their dependencies to include this fix. For detailed information about the patch and related discussions, refer to the GitHub Commit Log, GitHub Issue Discussion, and related pull requests #295 and #296.

Workarounds

Implement wrapper functions that validate extraction paths before calling the vulnerable method
Use alternative archive extraction libraries that include built-in path traversal protection
Pre-scan archive contents and reject any entries containing path traversal sequences
Restrict file system permissions for processes that perform archive extraction operations
Isolate archive extraction in sandboxed environments with limited file system access

bash

# Configuration example - Verify plexus-utils version in Maven dependencies
mvn dependency:tree | grep plexus-utils
# Update pom.xml to use patched version
# Check for transitive dependencies that may include vulnerable versions
mvn dependency:analyze -DignoreNonCompile