Skip to content

[GHSA-6fmv-xxpf-w3cw] Plexus-Utils has a Directory Traversal vulnerability in its extractFile method #7333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
advisory-database merged 1 commit into from
Apr 8, 2026
Merged

[GHSA-6fmv-xxpf-w3cw] Plexus-Utils has a Directory Traversal vulnerability in its extractFile method #7333

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions advisories/github-reviewed/2026/03/GHSA-6fmv-xxpf-w3cw/GHSA-6fmv-xxpf-w3cw.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fmv-xxpf-w3cw",
"modified": "2026-03-27T19:40:25Z",
"modified": "2026-03-27T19:40:26Z",
"published": "2026-03-25T18:31:55Z",
"aliases": [
"CVE-2025-67030"
Expand All @@ -27,10 +27,26 @@
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.0.2"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.codehaus.plexus:plexus-utils"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1"
}
Comment on lines +40 to +46
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The two affected entries for org.codehaus.plexus:plexus-utils both start with introduced: "0", which makes the ranges overlap; the combined meaning becomes “all versions < 4.0.3 are affected”, incorrectly marking 3.6.1+ as vulnerable. Model this like other advisories with multiple disjoint ranges (e.g. separate entries with different introduced values): one range should cover < 3.6.1, and the other should start at the first affected 4.x release (e.g. introduced: "4.0.0") and fix at 4.0.3, or represent both segments in a single range’s events.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Author

@timtebeek timtebeek Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair; please update the 4.x range accordingly to start from 4.0.0; or give me instructions without opening a new pull request.

]
}
]
}
],
"references": [
Expand Down
Loading