CVE-2025-70952: pf4j Path Traversal Vulnerability

CVE-2025-70952 Overview

CVE-2025-70952 is a path traversal vulnerability affecting pf4j (Plugin Framework for Java) in versions prior to commit 20c2f80. The vulnerability exists in the extract() function of Unzip.java, where improper handling of zip entry names allows directory traversal or Zip Slip attacks due to a lack of proper path normalization and validation.

Critical Impact

Attackers can exploit this vulnerability to write arbitrary files outside the intended extraction directory, potentially overwriting critical system files or application binaries to achieve remote code execution.

Affected Products

• pf4j versions prior to commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14
• Applications using vulnerable pf4j plugin extraction functionality
• Java applications implementing pf4j for plugin management

Discovery Timeline

• 2026-03-25 - CVE CVE-2025-70952 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-70952

Vulnerability Analysis

This path traversal vulnerability, commonly known as "Zip Slip," occurs when the pf4j framework extracts plugin archives without properly validating the destination paths of extracted files. When a malicious plugin ZIP file containing entries with directory traversal sequences (such as ../../../etc/passwd or similar patterns) is processed, the extract() function in Unzip.java fails to normalize and validate the resulting file paths.

The lack of proper path validation means that an attacker can craft a malicious ZIP archive where file entries contain relative path components that escape the intended extraction directory. When the vulnerable extract() function processes these entries, files are written to arbitrary locations on the filesystem, potentially overwriting configuration files, executables, or other sensitive data.

Root Cause

The root cause of this vulnerability is insufficient input validation in the extract() function of Unzip.java. The function fails to:

1. Normalize the extracted file paths to resolve relative path components
2. Validate that the final destination path remains within the intended extraction directory
3. Reject or sanitize zip entries containing directory traversal sequences like ../

Without these safeguards, the function trusts the file names within the ZIP archive and writes files to whatever path is specified, allowing escape from the intended directory.

Attack Vector

The attack requires an adversary to provide a malicious ZIP file to be processed by the vulnerable pf4j extraction functionality. This could occur through:

1. Uploading a malicious plugin to an application that uses pf4j for plugin management
2. Tricking an administrator into installing a crafted plugin package
3. Compromising a plugin repository or distribution channel

When the malicious archive is extracted, files are written to attacker-controlled paths outside the intended plugin directory. Successful exploitation can lead to arbitrary file write, configuration tampering, or code execution if system binaries or startup scripts are overwritten.

The vulnerability mechanism involves crafted ZIP entries with traversal sequences in their names. When extracted without proper path validation, these entries escape the target directory and write to arbitrary filesystem locations. For detailed technical information and proof-of-concept examples, see the GitHub Gist PoC and GitHub Issue Discussion #618.

Detection Methods for CVE-2025-70952

Indicators of Compromise

• Unexpected files appearing in directories outside plugin installation paths
• Modified system files, configuration files, or application binaries with recent timestamps
• ZIP extraction operations writing to paths containing ../ sequences in logs
• Unusual file write events to sensitive directories during plugin installation

Detection Strategies

• Monitor filesystem events for file creation in unexpected directories during plugin extraction operations
• Implement file integrity monitoring on critical system and application files
• Analyze application logs for extraction operations involving paths with directory traversal patterns
• Deploy runtime application self-protection (RASP) to detect path traversal attempts

Monitoring Recommendations

• Enable detailed logging for all plugin installation and extraction operations
• Set up alerts for file modifications in sensitive system directories during plugin-related activities
• Review pf4j-based application logs for extraction path anomalies
• Implement canary files in critical directories to detect unauthorized modifications

How to Mitigate CVE-2025-70952

Immediate Actions Required

• Update pf4j to a version containing commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14 or later
• Audit all existing plugins for potential malicious content before extraction
• Restrict plugin installation to trusted sources only
• Implement additional filesystem access controls around plugin directories

Patch Information

The vulnerability has been addressed in commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14. Organizations should update their pf4j dependency to include this fix. The patch implements proper path normalization and validation to ensure extracted files cannot escape the intended destination directory.

For patch details, see the GitHub Commit Changes. Additional discussion is available in GitHub Issue Discussion #623.

Workarounds

• Implement a wrapper around the extraction functionality that validates destination paths before file write operations
• Use containerization or sandboxing to limit the filesystem access of applications using pf4j
• Deploy file system permissions to prevent the application from writing outside designated directories
• Manually validate plugin archives before installation using tools that detect Zip Slip vulnerabilities

# Configuration example
# Verify pf4j version includes the security fix
# Check if your project uses the patched commit
git log --oneline | grep 20c2f80

# Update pf4j in Maven pom.xml to latest version
# Ensure version >= 3.x.x with commit 20c2f80 included

# Restrict plugin directory permissions
chmod 755 /app/plugins
chown -R appuser:appgroup /app/plugins