Search threats, CVEs… ⌘K
Back to vendor advisories
Microsoft Security Response CenterCVE-2025-67030

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

HighVendor CVSS 8.8 / 10 1 CVE Published Mar 29, 2026 at 1:02 AM UTC
Get alerts for cbl2 javapackages-bootstrap 1.5.0-7 on CBL Mariner

Summary

Mariner

Products covered

  • cbl2 javapackages-bootstrap 1.5.0-7 on CBL Mariner 2.0

  • azl3 plexus-utils 3.3.0-5 on Azure Linux 3.0

  • cbl2 plexus-utils 3.3.0-4 on CBL Mariner 2.0

  • azl3 plexus-utils 3.3.0-4 on Azure Linux 3.0

  • cbl2 plexus-utils 3.3.0-3 on CBL Mariner 2.0

  • cbl2 javapackages-bootstrap 1.5.0-7 on CBL-Mariner 2.0

Remediation

CBL-Mariner Releases Release Notes

Vendor-listed fixes

  • 3.3.0-5

  • 3.3.0-4

CVEs in this advisory 1

CVE-2025-67030

Updates

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Updated by Microsoft Security Response Center

    The vendor changed the advisory after it was first published.

  3. Added to SecurityAlert

    We collected the advisory from the official source.

Keep investigating
See every advisory from this vendor