Red Hat Security Advisory: plexus-utils security update

Fixed packages 1

Vulnerabilities 1

• High 8.8
  CVE-2025-67030

  Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

  Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

  druid akhq dependency-track-bundled dependency-track Debian Ubuntu Azure Linux Wolfi Maven
  Mar 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451409
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35997.json
• report
  https://access.redhat.com/security/cve/CVE-2025-67030
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-67030
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-67030
• article
  https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
• article
  https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
• article
  https://github.com/codehaus-plexus/plexus-utils/issues/294
• article
  https://github.com/codehaus-plexus/plexus-utils/pull/295
• article
  https://github.com/codehaus-plexus/plexus-utils/pull/296