Vulnerabilities

TI-2025-41106 CVE-2025-67030 · GHSA-6fmv-xxpf-w3cw

Directory Traversal vulnerability in the extractFile method of…

MEDIUM 41

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00689 Published 2026-03-25 Partial fix · 4.0.3, 3.6.1 CWE-22

TI-2022-03886 CVE-2022-4245 · GHSA-jcwr-x25h-x5fh

Codehaus-plexus: xml external entity (xxe) injection

LOW 21

A flaw was found in codehaus-plexus.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00694 Published 2023-09-25 Partial fix · 3.0.24 CWE-91

TI-2022-03885 CVE-2022-4244 · GHSA-g6ph-x5wf-g337

Codehaus-plexus: directory traversal

HIGH 72

A flaw was found in codeplex-codehaus.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01347 Published 2023-09-25 Partial fix · 3.0.24 CWE-22

TI-2023-19069 CVE-2023-37460 · GHSA-wh3p-fphp-9h2m

Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver

HIGH 76

Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02482 Published 2023-07-25 Partial fix · 4.8.0 CWE-22

TI-2018-16132 CVE-2018-1002200 · GHSA-hcxq-x77q-3469

Path traversal in Codehaus plexus-archiver

LOW 38

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.11579 Published 2018-07-25 Partial fix · 3.6.0 CWE-22

TI-2017-14696 CVE-2017-1000487 · GHSA-8vhq-qq4p-grq3

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not…

MEDIUM 51

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0649 Published 2018-01-03 Partial fix · 3.0.16 CWE-78