The vulnerability CVE-2025-67030 is a Directory Traversal flaw in the extractFile method of the plexus-utils library, allowing attackers to execute arbitrary code in the context of the current user by exploiting improper limitation of pathname to a restricted directory (CWE-22). The issue affects all versions prior to the commit 6d780b3378829318ba5c2d29547e0012d5b29642. Red Hat's advisory confirms the vulnerability and notes that no straightforward mitigation is currently available that meets their criteria. However, a security update fixing this vulnerability is included in Red Hat JBoss Enterprise Application Platform 8.1.6 for RHEL 8. The CVSS v3.1 score is 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability allows attackers to read, modify, or delete critical files, potentially leading to unauthorized code execution, data exposure, or denial of service.

An attacker exploiting this vulnerability can execute arbitrary code with the privileges of the current user by leveraging directory traversal to create, overwrite, or read critical files. This can lead to unauthorized code execution, data disclosure, integrity violations, and denial of service conditions by corrupting or deleting important files. The vulnerability has a high impact on confidentiality, integrity, and availability as per the CVSS score. No known exploits in the wild have been reported at this time.

Red Hat currently does not offer a mitigation that meets their criteria for ease of use, applicability, or stability. The recommended remediation is to apply the security update provided in Red Hat JBoss Enterprise Application Platform 8.1.6 for RHEL 8, which includes a fix for this vulnerability. Users should ensure all relevant errata are applied and back up their systems before updating. For products outside this platform, check vendor advisories for patch availability. No alternative mitigations are currently endorsed by Red Hat.