high7.5
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory …
Impact
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.pf4j:pf4j | < 3.14.1 | 3.14.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pf4j Project | Pf4j | before 3.14.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5458-7hh9-v7p4
- https://nvd.nist.gov/vuln/detail/CVE-2025-70952
- https://github.com/pf4j/pf4j/issues/618
- https://github.com/pf4j/pf4j/issues/623
- https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14
- https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705