debian/plexus-utils2 vulnerabilities

Latest debian/plexus-utils2 CVEs

Newest publication first

1. CVE-2025-67030 Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

   Published 2026-03-25

   High·CVSS 8.8

   Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

2. CVE-2022-4245 Codehaus-plexus: xml external entity (xxe) injection

   Published 2023-09-25

   Medium·CVSS 4.3

   A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

3. CVE-2022-4244 Codehaus-plexus: directory traversal

   Published 2023-09-25

   High·CVSS 7.5

   A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file pa...

4. DSA-4149-1 plexus-utils2 - security update

   Published 2018-03-22

   Unknown

5. DLA-1237-1 plexus-utils2 - security update

   Published 2018-01-09

   Unknown

6. CVE-2017-1000487 OS Command Injection in Plexus-utils

   Published 2018-01-03

   Critical·CVSS 9.8

   Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.