Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-37460 is a high-severity Path Traversal (CWE-22) vulnerability in Codehaus-Plexus Plexus-Archiver. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 17% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Plexus Archiver, a library providing a unified API for creating and extracting archives, is affected by CVE-2023-37460 in all versions prior to 4.8.0. The flaw resides in AbstractUnArchiver's handling of archive entries that resolve to existing symbolic links whose targets are absent; resolveFile() returns the link source rather than its target, bypassing the destination-directory check, after which Files.newOutputStream() follows the symlink and writes attacker-controlled content to an arbitrary location on the filesystem. The issue is tracked under CWE-22 and CWE-61 and carries a CVSS 3.1 score of 8.1.
An attacker who can supply a malicious archive to any application that uses Plexus Archiver for extraction can trigger creation of files outside the intended destination directory. Because the written content is fully controlled by the archive entry, the attacker may place executables, configuration files, or scripts in locations that later lead to remote code execution when those files are processed by the victim application or system.
The project maintainers addressed the vulnerability in version 4.8.0; the corresponding patch and release are documented in the GitHub Security Advisory GHSA-wh3p-fphp-9h2m together with the commits that corrected symlink resolution. Users are advised to upgrade Plexus Archiver to 4.8.0 or later and to ensure any downstream components that embed the library are also updated.
EPSS for the CVE currently stands at 0.3791 with a recorded peak of 0.4068; no public evidence of in-the-wild exploitation has been reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2164
Vulnerability Data
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and…
more
possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V5.3.2V5.2.5
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of symlink-following flaws in file-handling code.
Vulnerability identification can discover existing symlink issues but does not prevent or remediate them in code.
Least-privilege access policies can limit damage from symlink attacks but do not address the coding flaw itself.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-61