Read the docs
TI-2018-16132 Aliases CVE-2018-1002200GHSA-hcxq-x77q-3469

Path traversal in Codehaus plexus-archiver

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 13 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Why it matters now

EPSS 0.11579 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial plexus-archiver (Codehaus): 3.6.0org.codehaus.plexus:plexus-archiver (Maven): 3.6.0Red Hat: 2 advisoriesRed Hat: 13 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Codehausplexus-archiverbefore 3.6.03.6.0Patch availableCNA
—org.codehaus.plexus:plexus-archiver (Maven)before 3.6.03.6.0Patch availableGHSA-hcxq-x77q-3469
  • plexus-archiver VendorCodehaus Affected before 3.6.0 Fixed in 3.6.0 Patch available CNA
  • org.codehaus.plexus:plexus-archiver (Maven) Vendor— Affected before 3.6.0 Fixed in 3.6.0 Patch available GHSA-hcxq-x77q-3469

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:codehaus-plexus:plexus-archiver:*:*:*:*:*:*:*:*before 3.6.0Vulnerablecodehaus-plexus
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:codehaus-plexus:plexus-archiver:*:*:*:*:*:*:*:* Versions before 3.6.0 Vulnerable ·codehaus-plexus
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA plexus-archiver (Codehaus) Fixed in 3.6.0
  • Fix · GHSA-hcxq-x77q-3469 org.codehaus.plexus:plexus-archiver (Maven) Fixed in 3.6.0 Advisory →

Red Hat 2 advisories

  • RHSA-2018:1837 Released 2018-06-12 · Red Hat rating Important
    rh-maven33-plexus-archiver and rh-maven35-plexus-archiver security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-maven33-plexus-archiver-2.4.2-5.1.el6, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven33-plexus-archiver-2.4.2-5.1.el7, rh-maven33-plexus-archiver-javadoc-2.4.2-5.1.el7, rh-maven35-plexus-archiver-3.4-4.1.el7 +1
  • RHSA-2018:1836 Released 2018-06-12 · Red Hat rating Important
    plexus-archiver security update
    • Red Hat Enterprise Linux Client Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
    • Red Hat Enterprise Linux Server Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
    • Red Hat Enterprise Linux Workstation Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) plexus-archiver-2.4.2-5.el7_5, plexus-archiver-javadoc-2.4.2-5.el7_5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2018:1836
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2018:1836
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2018:1836
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2018:1836
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2018:1836
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2018:1837
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:1837
Not affected: 4 products
  • JBoss Developer Studio 9
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat JBoss Fuse Integration Service 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1002200
  2. 2026-10-03 Alias added: GHSA-hcxq-x77q-3469

References

Exploit 2

Patch 1

Advisory 4

Other 1

  • TI-2012-04858 Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and… CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences