plexus-build-api-1.2.0.jar: 1 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - plexus-build-api-1.2.0.jar

Path to dependency file: /artemis-java-template/pom.xml

Path to vulnerable library: /artemis-java-template/pom.xml

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (plexus-build-api version)	Remediation Possible**
CVE-2025-67030	Critical	9.8	plexus-utils-4.0.2.jar	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-67030

Vulnerable Library - plexus-utils-4.0.2.jar

A collection of various utility classes to ease working with strings, files, command lines and more.

Library home page: https://codehaus-plexus.github.io/plexus-utils/

Path to dependency file: /artemis-java-template/pom.xml

Path to vulnerable library: /artemis-java-template/pom.xml

Dependency Hierarchy:

• plexus-build-api-1.2.0.jar (Root Library)
  • ❌ plexus-utils-4.0.2.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Publish Date: 2026-03-25

URL: CVE-2025-67030

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here