PT-2026-28076 · Apache · Plexus-Utils

Published 2026-03-25 · Updated 2026-05-22 · CVE-2025-67030

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions plexus-utils versions prior to 6d780b3378829318ba5c2d29547e0012d5b29642

Description A directory traversal issue exists in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils. This allows an attacker to execute arbitrary code.

Recommendations Update plexus-utils to a version newer than 6d780b3378829318ba5c2d29547e0012d5b29642.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-AO61361

CLEANSTART-2026-PV53006

CVE-2025-67030

GHSA-6FMV-XXPF-W3CW

OPENSUSE-SU-2026:10439-1

OPENSUSE-SU-2026:20535-1

SUSE-SU-2026:1396-1

SUSE-SU-2026:21194-1

Affected Products

Plexus-Utils

References · 85

• https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 · Patch
• https://github.com/codehaus-plexus/plexus-utils/pull/296 · Patch
• https://github.com/codehaus-plexus/plexus-utils/pull/295 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42499 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-67030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39817 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21194-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AO61361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/GHSA-6fmv-xxpf-w3cw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Security Note