CVE-2025-67030 is a directory traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils. This vulnerability allows an attacker to execute arbitrary code by exploiting improper validation of file paths during extraction. The issue affects all versions of plexus-utils prior to commit 6d780b3378829318ba5c2d29547e0012d5b29642. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. Red Hat has published multiple advisories and errata providing security updates for affected products, including Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8. These updates address the vulnerability and should be applied to remediate the issue.

Successful exploitation of this directory traversal vulnerability can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability of affected systems. This can allow attackers to execute malicious code remotely without privileges and with low attack complexity. The vulnerability poses a significant risk to systems using affected versions of plexus-utils, especially within Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8. No known exploits in the wild have been reported at this time.

A security update addressing CVE-2025-67030 is available from Red Hat for Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8. Users should apply the relevant errata and security advisories (e.g., RHSA-2026:18054 and related advisories) to remediate this vulnerability. Before applying updates, ensure all previously released errata are applied and back up existing installations, including applications and configurations. Patch status is confirmed by the vendor advisories linked. No additional mitigation steps are indicated beyond applying the official fixes.