CVE-2025-67030: 
Java vulnerability analysis and mitigation

CVE-2025-67030 is a directory traversal (Zip Slip) vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in the plexus-utils Java library. The flaw allows an attacker to craft a malicious archive file that, when extracted by a vulnerable application, writes files outside the intended target directory — potentially enabling arbitrary code execution. It affects plexus-utils versions before 3.6.1 (3.x branch) and versions 4.0.0–4.0.2 (fixed in 4.0.3). The vulnerability was reported on September 2, 2025, the fix was merged on November 9, 2025, and the CVE was published on March 25, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, GitHub PR #296).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable code in Expand.extractFile() used f.getAbsolutePath().startsWith(dir.getAbsolutePath()) to validate that extracted archive entries remain within the target directory. This check is bypassable in at least two ways: (1) partial prefix matching — if the target directory is /tmp/app, a malicious entry resolving to /tmp/app-data/evil.txt passes the check because the string starts with /tmp/app; and (2) symlink bypass — getAbsolutePath() does not resolve symbolic links, allowing traversal via symlinked path components. The fix (commit 6d780b3) replaces this with canonical path comparison using getCanonicalPath() plus a file separator suffix check, preventing both bypass techniques (GitHub Issue #294, GitHub Commit).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the application's process account, which can lead to remote code execution — for example, by overwriting startup scripts, configuration files, or deploying web shells. The impact spans high confidentiality, integrity, and availability, as an attacker could exfiltrate data, corrupt application state, or achieve persistent access. Downstream products confirmed affected include IBM App Connect Enterprise, IBM Integration Bus for z/OS, IBM Business Automation Manager Open Editions, IBM Quantum Safe Explorer, IBM Instana Observability, Atlassian Bamboo/Confluence/Jira (via transitive dependency), and Splunk AppDynamics Machine Agent (IBM Advisory, Atlassian Bulletin, Splunk Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly Intel). The vulnerability requires user interaction — specifically, a user or automated process must extract a malicious archive — but requires no authentication or special privileges from the attacker. The EPSS score is approximately 0.0013 (0.13%), indicating low current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus (IDs 303763, 311338) and Qualys (IDs 6638894, 6763336) (Feedly Intel).

1. Craft a malicious archive: Create a ZIP file containing an entry with a path-traversal sequence in its name, such as ../../evil.sh or a path targeting a sibling directory (e.g., ../app-data/evil.txt) to exploit the partial prefix match bypass.
2. Deliver the archive: Distribute the malicious ZIP to a target system where a vulnerable version of plexus-utils (< 3.6.1 or 4.0.0–4.0.2) is used to process archive files — for example, via a Maven build process, a file upload endpoint, or a CI/CD pipeline artifact.
3. Trigger extraction: Cause the target application to extract the archive using the vulnerable Expand.extractFile() method. This may happen automatically (e.g., during a build) or require social engineering to get a user to initiate extraction.
4. Achieve arbitrary file write: The insufficient getAbsolutePath().startsWith() check passes for the crafted entry, and the file is written to the attacker-controlled path outside the intended extraction directory.
5. Escalate to code execution: Overwrite a sensitive file (e.g., a cron job, startup script, or application configuration) with attacker-controlled content to achieve code execution under the application's privileges (GitHub PR #296, GitHub Issue #294).

• File System: Unexpected files appearing outside the designated archive extraction directory, particularly in parent or sibling directories; new or modified scripts/configuration files in sensitive locations (e.g., /etc/cron.d/, application config directories) with timestamps coinciding with archive extraction events.
• Logs: Application or build tool logs showing archive extraction operations followed by IOException messages referencing "Entry outside the target directory" (indicating attempted exploitation that was blocked post-patch); unexpected file creation events logged by file integrity monitoring tools.
• Process: Unusual child processes spawned by Java-based build tools or application servers (e.g., Maven, Gradle, Bamboo agents) shortly after archive extraction, such as shell interpreters or network utilities.
• Network: Outbound connections from build servers or application hosts to unknown external IPs following archive processing, which may indicate post-exploitation activity.

Upgrade plexus-utils to version 3.6.1 (for the 3.x branch) or 4.0.3 (for the 4.x branch), which contain the canonical path validation fix (GitHub Commit). For Maven projects, explicitly pin the plexus-utils dependency version in your POM or use dependency management to force the patched version across transitive dependencies. As a workaround where immediate patching is not possible, restrict the ability of applications to process untrusted or externally sourced archive files. Downstream product users should apply vendor-specific patches: IBM has released fixes for App Connect Enterprise, Integration Bus for z/OS, Business Automation Manager Open Editions, Quantum Safe Explorer, and Instana Observability; Splunk has updated AppDynamics Machine Agent; and Atlassian addressed the issue in its May 19, 2026 security bulletin (IBM Advisory, Atlassian Bulletin).

The vulnerability generated notable activity in the Java/Maven ecosystem, with multiple downstream projects (Gradle, OpenRewrite, JRuby ruby-maven-libs, and others) filing issues and PRs to pin or upgrade plexus-utils to the patched version (GitHub PR #296). Community discussion on the GitHub PR highlighted a delay between the fix being merged (November 2025) and the 3.6.1 release (April 2026), which left Maven 3.x users exposed for several months. Major vendors including IBM, Microsoft, Atlassian, and Splunk issued security advisories acknowledging the impact on their products (Atlassian Bulletin, Splunk Advisory).