## Summary
CVE-2025-67030 is a directory traversal issue in org.codehaus.plexus.util.Expand (extractFile method) in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. The flaw can allow an attacker to write outside the intended extraction directory and, per the NVD description, execute arbitrary code.
## Technical Details
- Vulnerable component: org.codehaus.plexus.util.Expand → extractFile
- Root cause (from issue discussion): extractFile resolves archive entry paths using FileUtils.resolveFile(dir, entryName) where entryName is external input.
- Defense weakness: the containment check uses f.getAbsolutePath().startsWith(dir.getAbsolutePath()), which is insufficient because it relies on string prefix matching rather than canonical path comparison.
- The issue notes bypass potential via different path representations (e.g., symlinks, case differences, redundant path elements) and that the check can be prone to false negatives/incorrect containment decisions.
## Affected
- plexus-utils versions: before 6d780b3378829318ba5c2d29547e0012d5b29642
- Affected package identifiers: codehaus-plexus, plexus-utils (as provided)
## Impact
- Directory traversal leading to file write outside the target directory.
- Arbitrary code execution is claimed by the NVD description.
- CVSS vector provided: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
## Mitigation
1. Upgrade plexus-utils to a version that includes the fix associated with commit 6d780b3378829318ba5c2d29547e0012d5b29642.
2. If upgrade is not immediately possible, avoid extracting untrusted archives with Expand (or ensure archives are strictly validated before calling expand.execute()).
3. Add monitoring for unexpected filesystem writes during archive extraction workflows (e.g., files created outside the configured destination directory).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-22