The vulnerability CVE-2025-67030 exists in the extractFile method of the org.codehaus.plexus.util.Expand class within plexus-utils. It is a directory traversal vulnerability (CWE-22) that can be exploited to execute arbitrary code. The affected versions include =10, <10.2, >=8.0.0 <8.10.1, and >=9.2.0 <9.2.2. Red Hat has released security advisories RHSA-2026:35990 and RHSA-2026:35991 detailing the issue and providing updated plexus-utils packages to remediate the vulnerability. The CVSS v3.1 score is 8.8 (High), indicating a network attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisories confirm the availability of official patches and provide instructions for applying updates.

Successful exploitation of this directory traversal vulnerability allows an attacker to execute arbitrary code on affected systems. The CVSS score of 8.8 reflects a high severity impact with potential full compromise of confidentiality, integrity, and availability. There are no known exploits in the wild at this time. The vulnerability affects multiple Red Hat Enterprise Linux versions and related products using plexus-utils.

Red Hat has released official security updates for plexus-utils that fix this vulnerability. Users should apply the updated packages as detailed in Red Hat advisories RHSA-2026:35990 and RHSA-2026:35991. The advisories provide package names and versions for affected Red Hat Enterprise Linux 9.2 and 10.0 distributions. Applying these updates will remediate the vulnerability. No additional mitigation steps are required beyond applying the official patches.