CVE-2025-67030
- ULN >
- Oracle Linux CVE repository >
- CVE-2025-67030
CVE Details
| Release Date: | 2026-03-25 | |
| Impact: | Important | What is this? |
Description
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
See more information about CVE-2025-67030 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 8.3 |
| Vector String: | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| Version: | 3.1 |
| Attack Vector: | Network |
| Attack Complexity: | Low |
| Privileges Required: | None |
| User Interaction: | None |
| Scope: | Changed |
| Confidentiality Impact: | Low |
| Integrity Impact: | Low |
| Availability Impact: | Low |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 10 (plexus-utils) | ELSA-2026-38514 | 2026-07-16 |
| Oracle Linux version 8 (ant-contrib) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (antlr) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-commons-beanutils) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-commons-cli) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (apache-commons-codec) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (apache-commons-exec) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-commons-io) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (apache-commons-lang3) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (apache-commons-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-ivy) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (apache-resource-bundles) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (aqute-bnd) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (assertj-core) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (atinject) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (bcel) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (beust-jcommander) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (bsf) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (bsh) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (byaccj) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (cal10n) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (cdi-api) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (cglib) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (easymock) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (exec-maven-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (felix-osgi-compendium) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (felix-osgi-core) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (felix-osgi-foundation) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (felix-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (felix-utils) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (forge-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (fusesource-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (geronimo-jms) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (geronimo-jpa) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (geronimo-parent-poms) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (glassfish-legal) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (glassfish-master-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (google-guice) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (guava) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (hawtjni) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (httpcomponents-client) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (httpcomponents-core) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (httpcomponents-project) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (isorelax) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jakarta-annotations) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (jakarta-oro) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jansi) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (java_cup) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (javacc) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (javacc-maven-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (javamail) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (javapackages-tools) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jaxen) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jboss-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jdepend) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jdependency) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jdom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jdom2) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jflex) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jsr-305) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (jtidy) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (jvnet-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (maven-antrun-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-archiver) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-artifact-resolver) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-artifact-transfer) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-assembly-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-clean-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-common-artifact-filters) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-compiler-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-dependency-analyzer) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-dependency-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-dependency-tree) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-doxia) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-doxia-sitetools) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-enforcer) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-file-management) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-filtering) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-install-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-invoker) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-invoker-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-jar-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-plugin-build-helper) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-plugin-bundle) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-plugin-testing) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-plugin-tools) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-plugins-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-remote-resources-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-reporting-api) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-reporting-impl) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-resolver) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (maven-resources-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-script-interpreter) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-shade-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-shared) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-shared-incremental) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-shared-io) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-shared-utils) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (maven-source-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-surefire) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-verifier) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (maven-wagon) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (maven2) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (mockito) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (modello) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (mojo-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (munge-maven-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (objectweb-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (objenesis) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (os-maven-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (osgi-annotation) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (osgi-compendium) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (osgi-core) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-ant-factory) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-archiver) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-bsh-factory) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-build-api) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-cipher) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-classworlds) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-cli) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-compiler) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-component-api) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-component-factories-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-components-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-containers) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-containers) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-i18n) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-interactivity) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-interpolation) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-io) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-languages) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-pom) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-resources) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (plexus-sec-dispatcher) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-utils) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (plexus-velocity) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (powermock) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (qdox) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (regexp) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (sisu) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (sisu-mojos) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (slf4j) | ELSA-2026-40841 | 2026-07-20 |
| Oracle Linux version 8 (sonatype-oss-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (sonatype-plugins-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (spec-version-maven-plugin) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (spice-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (testng) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (weld-parent) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (xbean) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (xmlunit) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 8 (xmvn) | ELSA-2026-41948 | 2026-07-31 |
| Oracle Linux version 9 (aopalliance) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (apache-commons-cli) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (apache-commons-codec) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (apache-commons-io) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (atinject) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (google-guice) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (guava) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (httpcomponents-client) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (httpcomponents-core) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (jakarta-annotations) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (jansi) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (jsr-305) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (maven) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (maven-resolver) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (maven-shared-utils) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (maven-wagon) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-cipher) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-classworlds) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-containers) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-interpolation) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-sec-dispatcher) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-utils) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (plexus-utils) | ELSA-2026-38796 | 2026-07-20 |
| Oracle Linux version 9 (sisu) | ELSA-2026-38500 | 2026-07-15 |
| Oracle Linux version 9 (slf4j) | ELSA-2026-38500 | 2026-07-15 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
