CVE-2025-67030

HighUpdated

Published: 25 March 2026

Published

25 March 2026

Modified

01 May 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0037 59.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67030 is a high-severity Path Traversal (CWE-22) vulnerability in Codehaus-Plexus Plexus-Utils. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 41.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mandates timely patching of the vulnerable plexus-utils library to the fixing commit, eliminating the directory traversal vulnerability.

SI-10 Information Input Validation good match

prevent

Requires validation of inputs to the extractFile method to block malicious path traversal attempts leading to arbitrary code execution.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Enables vulnerability scanning to identify and prioritize the plexus-utils directory traversal flaw for remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Directory traversal in archive extraction enables arbitrary code execution via crafted malicious files processed by vulnerable applications, directly facilitating Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Deeper analysisAI

CVE-2025-67030 is a directory traversal vulnerability (CWE-22) in the extractFile method of the org.codehaus.plexus.util.Expand class within the plexus-utils library, affecting versions prior to the commit 6d780b3378829318ba5c2d29547e0012d5b29642. Published on 2026-03-25, this flaw carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An unauthenticated attacker accessible over the network can exploit this vulnerability with low complexity, though it requires user interaction. Successful exploitation enables arbitrary code execution on the target system, compromising confidentiality, integrity, and availability with high impact.

Mitigation involves updating plexus-utils to the fixing commit 6d780b3378829318ba5c2d29547e0012d5b29642 or later, as detailed in the project's GitHub repository. Related discussions and pull requests, including issue #294 and pulls #295 and #296, provide further context on the patch and resolution.