This vulnerability (CVE-2025-67030) affects the extractFile method in the plexus-utils library, specifically in the org.codehaus.plexus.util.Expand class. The issue is a directory traversal flaw (CWE-22) that could allow an attacker to write files outside the intended extraction directory, potentially leading to arbitrary code execution. The affected versions are prior to commit 6d780b3378829318ba5c2d29547e0012d5b29642. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary code on the affected system by leveraging directory traversal to place malicious files in unintended locations. This impacts confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when processing untrusted input with the affected extractFile method. Monitor vendor channels for updates and apply patches promptly once released.