RLSA-2026:38796
- Source
- https://errata.rockylinux.org/RLSA-2026:38796
- Import Source
- https://storage.googleapis.com/resf-osv-data/RLSA-2026:38796.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/RLSA-2026:38796
- Upstream
- Published
- 2026-07-29T18:03:49.873824Z
- Modified
- 2026-07-29T18:25:50.511847732Z
- Severity
-
- 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
- Summary
- Important: plexus-utils security update
- Details
-
The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.
Security Fix(es):
- org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- References
- Credits
-
-
- Rocky Enterprise Software Foundation
-
- Red Hat
-
Affected packages
Rocky Linux:9 / plexus-utils
Package
- Name
- plexus-utils
- Purl
- pkg:rpm/rocky-linux/plexus-utils?distro=rocky-linux-9-x86-64&epoch=0