Directory Traversal vulnerability in the extractFile method of…
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 30 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00689 52nd percentileScored 2026-11-07
Fix Partial org.codehaus.plexus:plexus-utils (Maven): 4.0.3, 3.6.1Red Hat: 29 advisoriesRed Hat: 30 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.codehaus.plexus:plexus-utils (Maven) | 4.0.0 to before 4.0.3 | 4.0.3 | Patch available | GHSA-6fmv-xxpf-w3cw |
| — | org.codehaus.plexus:plexus-utils (Maven) | before 3.6.1 | 3.6.1 | Patch available | GHSA-6fmv-xxpf-w3cw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.codehaus.plexus:plexus-utils (Maven) Vendor— Affected 4.0.0 to before 4.0.3 Fixed in 4.0.3 Patch available GHSA-6fmv-xxpf-w3cw
- org.codehaus.plexus:plexus-utils (Maven) Vendor— Affected before 3.6.1 Fixed in 3.6.1 Patch available GHSA-6fmv-xxpf-w3cw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* | before 3.6.1; 4.0.0 to before 4.0.3 | Vulnerable | codehaus-plexus |
- cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* Versions before 3.6.1; 4.0.0 to before 4.0.3 Vulnerable ·codehaus-plexus
Remediation
- Fix · GHSA-6fmv-xxpf-w3cw org.codehaus.plexus:plexus-utils (Maven) Fixed in 4.0.3 Advisory →
- Fix · GHSA-6fmv-xxpf-w3cw org.codehaus.plexus:plexus-utils (Maven) Fixed in 3.6.1 Advisory →
Red Hat 29 advisories
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:60259 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60256 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 26 more Red Hat advisories
- RHSA-2026:60254 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60252 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60251 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60250 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60249 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60248 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60247 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60246 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60239 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:41948 Released 2026-07-20 · Red Hat rating Importantjavapackages-tools:201801 security update
- Red Hat Enterprise Linux CRB (v. 8) ant-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801, ant-1.10.5-1.module+el8.10.0+23274+27840b45.src::javapackages-tools:201801, ant-antlr-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801 +47
- RHSA-2026:40841 Released 2026-07-16 · Red Hat rating Importantmaven:3.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-cli-1.5.0-5.module+el8.10.0+21301+657f54a3.noarch::maven:3.8, apache-commons-cli-1.5.0-5.module+el8.10.0+21301+657f54a3.src::maven:3.8, apache-commons-codec-1.15-8.module+el8.10.0+21301+657f54a3.noarch::maven:3.8 +47
- RHSA-2026:38796 Released 2026-07-13 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream (v. 9) plexus-utils-3.3.0-14.el9_8
- RHSA-2026:38500 Released 2026-07-13 · Red Hat rating Importantmaven:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 9) aopalliance-1.0-51.module+el9.8.0+24092+eb9f67d0.noarch::maven:3.9, aopalliance-1.0-51.module+el9.8.0+24092+eb9f67d0.src::maven:3.9, apache-commons-cli-1.9.0-4.module+el9.8.0+24092+eb9f67d0.noarch::maven:3.9 +47
- RHSA-2026:38514 Released 2026-07-13 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream (v. 10) plexus-utils-3.5.1-9.el10_2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) plexus-utils-javadoc-3.5.1-9.el10_2
- RHSA-2026:36012 Released 2026-07-06 · Red Hat rating Importantmaven:3.9 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aopalliance-1.0-51.module+el9.6.0+22733+e520f63c.noarch::maven:3.9, aopalliance-1.0-51.module+el9.6.0+22733+e520f63c.src::maven:3.9, apache-commons-cli-1.9.0-4.module+el9.6.0+22733+e520f63c.noarch::maven:3.9 +47
- RHSA-2026:35997 Released 2026-07-06 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) plexus-utils-3.3.0-13.el9_6.1
- RHSA-2026:35996 Released 2026-07-06 · Red Hat rating Importantmaven:3.8 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) apache-commons-cli-1.5.0-4.module+el8.8.0+18044+0a924b8f.noarch::maven:3.8, apache-commons-cli-1.5.0-4.module+el8.8.0+18044+0a924b8f.src::maven:3.8, apache-commons-codec-1.15-7.module+el8.8.0+18044+0a924b8f.noarch::maven:3.8 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) apache-commons-cli-1.5.0-4.module+el8.8.0+18044+0a924b8f.noarch::maven:3.8, apache-commons-cli-1.5.0-4.module+el8.8.0+18044+0a924b8f.src::maven:3.8, apache-commons-codec-1.15-7.module+el8.8.0+18044+0a924b8f.noarch::maven:3.8 +47
- RHSA-2026:35992 Released 2026-07-06 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) plexus-utils-3.3.0-10.el9_4.2
- RHSA-2026:35991 Released 2026-07-06 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) plexus-utils-3.5.1-8.el10_0.1
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) plexus-utils-javadoc-3.5.1-8.el10_0.1
- RHSA-2026:35990 Released 2026-07-06 · Red Hat rating Importantplexus-utils security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) plexus-utils-3.3.0-10.el9_2.2
- RHSA-2026:18054 Released 2026-05-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.6 security update
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
- RHSA-2026:18055 Released 2026-05-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.6 security update
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
- RHSA-2026:18059 Released 2026-05-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.6 security update
- Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
- RHSA-2026:17668 Released 2026-05-14 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.18.1 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
- RHSA-2026:7109 Released 2026-04-14 · Red Hat rating ImportantRed Hat build of Quarkus 3.20.6 release and security update
- Red Hat build of Quarkus 3.20.6.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
- RHSA-2026:7380 Released 2026-04-14 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.3 release and security update
- Red Hat build of Quarkus 3.27.3.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka 2 | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:60247 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:60249 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:60248 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:60239 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:60251 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:60246 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:60250 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:60252 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:60259 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:60254 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:60256 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:38514 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:40841 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:38500, RHSA-2026:38796 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:35996 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:35990 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:35992 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:35991 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:35997, RHSA-2026:36012 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:35996 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:41948 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:38514 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:35991 |
| Red Hat JBoss EAP 8.1 for RHEL 8 | Fixed | RHSA-2026:18054 |
| Red Hat JBoss EAP 8.1 for RHEL 9 | Fixed | RHSA-2026:18055 |
| Red Hat JBoss Enterprise Application Platform 8.1.6.GA | Fixed | RHSA-2026:18059 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | Fixed | RHSA-2026:17668 |
| Red Hat build of Quarkus 3.20.6.redhat | Fixed | RHSA-2026:7109 |
| Red Hat build of Quarkus 3.27.3.redhat | Fixed | RHSA-2026:7380 |
Not affected: 28 products
- Cryostat 4
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat AMQ Broker 7
- Red Hat AMQ Clients
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Enterprise Application Platform 8.1.6.GA
- Red Hat JBoss Web Server 5
- Red Hat JBoss Web Server 6
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat build of Quarkus 3.20.6.redhat
- Red Hat build of Quarkus 3.27.3.redhat
- Red Hat build of Quarkus Native builder
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67030
- 2026-10-03 Alias added: GHSA-6fmv-xxpf-w3cw
- 2026-10-06 EPSS moved to the 50th–90th percentile
- 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
- 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA, Red Hat build of Quarkus 3.20.6.redhat, Red Hat build of Quarkus 3.27.3.redhat · Red Hat
- 2026-11-06 Fix available: RHSA-2026:35996 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:36012 · Red Hat
References
Patch 3
Advisory 2
More codehaus-plexus Plexus-utils vulnerabilities
- TI-2022-03885 Codehaus-plexus: directory traversal CVSS 3.1HIGH 7.5
- TI-2017-14696 Plexus-utils before 3.0.16 is vulnerable to command injection because it does not… CVSS 3.1CRITICAL 9.8
- TI-2022-03886 Codehaus-plexus: xml external entity (xxe) injection CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-67030 · CVE Program
- CVE-2025-67030 · NVD
- FIRST EPSS
- GHSA-6fmv-xxpf-w3cw · GitHub Advisory Database · CC BY 4.0
- CVE-2025-67030 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences