The vulnerability CVE-2025-67030 affects the plexus-utils library used by Maven 3.9, specifically a directory traversal flaw in the extractFile method. This flaw could allow an attacker to write files outside the intended extraction directory, potentially leading to unauthorized file system modifications. Red Hat has released a security advisory (RHSA-2026:36012) providing an update for Maven 3.9 on Red Hat Enterprise Linux 9.6 Extended Update Support to fix this issue. The advisory rates the security impact as Important and provides instructions for applying the update.

The directory traversal vulnerability allows an attacker to potentially write files to arbitrary locations on the file system during the extraction process, which could lead to unauthorized file modifications or code execution depending on the environment. The Red Hat advisory rates this issue as Important, indicating a significant security risk if left unpatched.

Red Hat has released an official security update for Maven 3.9 on Red Hat Enterprise Linux 9.6 Extended Update Support that addresses CVE-2025-67030. Users should apply this update promptly following the guidance in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are specified or required beyond applying the official patch.