CVE-2025-67030

What it actually does

The vulnerability is a directory traversal flaw in org.codehaus.plexus.util.Expand.extractFile in codehaus-plexus plexus-utils. When an application extracts an attacker-controlled archive using the affected library, archive entries containing traversal sequences can be written outside the intended extraction directory. If the attacker can place files into sensitive locations, this can lead to arbitrary file overwrite, configuration tampering, credential exposure, persistence, and, in favorable conditions, arbitrary code execution by writing executable scripts, application files, build artifacts, or startup-controlled files.

Why it matters to the business

Systems that process untrusted archives with vulnerable plexus-utils may allow an attacker to overwrite files on the server or build host, potentially leading to service compromise, data theft, corrupted builds, deployment of malicious code, or operational outage. Although EPSS is currently low and the issue is not listed in CISA KEV, the CVSS severity is high and the library is commonly used in Java and Maven-related tooling, so exposure can be indirect through applications, CI/CD systems, plugins, or developer tooling.

How an attack unfolds

An attacker first identifies an application, build process, plugin, or service that uses a vulnerable version of plexus-utils to extract archives supplied by users, dependencies, integrations, or automated workflows. The attacker crafts an archive containing entries with path traversal sequences such as ../ or ..\ so that, when extracted, files escape the intended destination directory. The victim system or a user-triggered workflow then processes the malicious archive. Because the vulnerable extractFile implementation does not adequately enforce that extracted files remain inside the target directory, the attacker-controlled file is written to an attacker-selected path. The attacker then abuses the written file, for example by overwriting application content, placing a script in a startup or scheduled execution path, modifying build output, adding an SSH key, or changing configuration so that code runs under the privileges of the affected process.

How to fix it

Upgrade codehaus-plexus plexus-utils to a release that includes the fix for commit 6d780b3378829318ba5c2d29547e0012d5b29642 or later. If an exact packaged fixed version is not available from the vendor or distribution, track the upstream advisory and consume the first release containing that commit. Rebuild and redeploy applications, plugins, containers, and build images that bundle the vulnerable JAR. Where immediate upgrade is not possible, do not extract untrusted archives with plexus-utils; reject archive entries containing traversal sequences, absolute paths, drive-letter paths, symlinks/hardlinks, or paths that canonicalize outside the intended extraction directory; extract into an isolated temporary directory with least privilege; and enforce filesystem permissions that prevent the extraction process from writing to application, startup, credential, or system directories.

How to confirm the fix worked

Confirm exposure by generating an SBOM or dependency tree for Java applications, plugins, CI images, build tools, and packaged artifacts, then identify vulnerable plexus-utils versions or JARs that predate commit 6d780b3378829318ba5c2d29547e0012d5b29642. Validate remediation by confirming the deployed artifact resolves to a fixed plexus-utils build, not merely that source manifests were changed. In a non-production environment, run a controlled archive-extraction test with entries such as ../outside.txt and verify the extraction is blocked or the file is not created outside the intended directory. Also verify container images, shaded JARs, fat JARs, Maven plugins, and CI worker images no longer contain the vulnerable library.

Typical attack path

1. Find a Java application, build tool, CI job, plugin, or service that uses vulnerable codehaus-plexus plexus-utils archive extraction.
2. Deliver or cause processing of a malicious archive through upload, import, dependency resolution, repository content, plugin input, or another archive-processing workflow.
3. Include archive entries with traversal paths such as ../, ..\, absolute paths, or nested traversal sequences that target files outside the extraction directory.
4. Wait for the vulnerable Expand.extractFile method to extract the archive.
5. Write or overwrite a file outside the intended extraction directory.
6. Trigger or wait for the affected application, operating system, build pipeline, or user workflow to execute or consume the attacker-written file.
7. Use resulting code execution or file overwrite to steal data, persist, alter builds, deploy malicious artifacts, or disrupt service.

How to detect it

To determine whether exploitation already occurred, review application, import, upload, build, repository, and CI/CD logs for archive processing events involving suspicious file names with traversal sequences or absolute paths. Correlate those events with filesystem changes outside expected extraction directories, especially newly created or modified startup scripts, application files, web content, SSH keys, scheduled jobs, CI configuration, Maven settings, or build outputs. On endpoints, review EDR/process telemetry for Java processes that unexpectedly spawned shells or interpreters such as sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, or package managers shortly after archive extraction. Use file integrity monitoring and backup comparison to identify unexpected overwrites near the time of archive ingestion. If web applications are involved, inspect access logs for archive uploads followed by new executable files or unusual requests to newly created files. Also search dependency and runtime logs for references to org.codehaus.plexus.util.Expand and failed or unusual extraction behavior involving parent-directory paths.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• org.codehaus.plexus.util.Expand
• org.codehaus.plexus.util.Expand.extractFile
• plexus-utils
• authorized_keys
• /etc/cron.d/
• /etc/crontab
• /var/spool/cron/
• /etc/systemd/system/
• .ssh/authorized_keys
• WEB-INF/web.xml
• .jsp
• .jspx
• cmd.exe /c
• powershell.exe
• /bin/sh -c
• /bin/bash -c

What your security team should do

• Prioritize identifying externally reachable services, file-import features, artifact-processing systems, and CI/CD workflows that extract user-supplied or third-party archives with plexus-utils.
• Upgrade or rebuild all affected Java applications, plugins, build images, and packaged artifacts to include the upstream fix commit or a fixed release containing it.
• Apply compensating controls immediately for archive-processing endpoints: restrict who can upload archives, scan archive member paths before extraction, and reject traversal, absolute, symlink, and hardlink entries.
• Harden extraction runtimes with least-privilege service accounts, read-only application directories, isolated temporary directories, container sandboxing, and restricted write permissions.
• Review recent file uploads, imports, builds, and artifact processing events for suspicious archive paths and unexpected file writes outside extraction directories.
• Monitor affected hosts for Java processes spawning shells, interpreters, package managers, or administrative utilities after archive extraction activity.
• Add dependency scanning and SBOM checks for plexus-utils across source repositories, packaged artifacts, container images, and CI worker images.