PT-2026-28084 · Pf4J · Pf4J

Published 2026-03-25 · Updated 2026-03-25 · CVE-2025-70952

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pf4j versions prior to 20c2f80

Description The software contains a path traversal issue in the extract() function within the Unzip.java file. Improper handling of zip entry names can lead to directory traversal or Zip Slip attacks because of insufficient path normalization and validation.

Recommendations Update to version 20c2f80 or later.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2025-70952

GHSA-5458-7HH9-V7P4

Affected Products

Pf4J

References · 12

• 🔥 https://github.com/pf4j/pf4j/issues/623 · Exploit
• https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-70952 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-70952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70952 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-70952 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-70952 · Security Note
• https://osv.dev/vulnerability/GHSA-5458-7hh9-v7p4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-70952 · Vendor Advisory
• https://github.com/pf4j/pf4j/issues/618 · Note
• https://github.com/pf4j/pf4j · Note
• https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705 · Note