Repository navigation
directory traversal still in org.codehaus.plexus.util.Expand #294
Description
Hi, we have detected a directory traversal vulnerability in the function extractFile in the class org.codehaus.plexus.util.Expand, The target function extractFile uses FileUtils.resolveFile(dir, entryName) to resolve the file path, where entryName is from an archive entry (external input). It then checks if the resolved file's absolute path starts with the target directory's absolute path using f.getAbsolutePath().startsWith(dir.getAbsolutePath()). This check is insufficient for preventing path traversal because it relies on string prefix matching, which can be bypassed if the resolved path uses different canonical forms (e.g., symlinks, case differences, or redundant path elements). Additionally, resolveFile normalizes the path but does not ensure it remains under the base directory; the check in extractFile is the primary defense. However, this check is vulnerable to partial matches (e.g., if dir is /tmp/app and an attacker uses entryName like ../app/../etc/passwd, the resolved path might be /etc/passwd, which does not start with /tmp/app—so it would be blocked—but if the attacker uses a path that shares a prefix, it might bypass). The code does not use canonicalization before the check, which is critical. The resolveFile function handles path separators and uses getCanonicalFile(), but the check in extractFile uses getAbsolutePath(), which may not be canonical.
This could allow bypasses via symlinks or other tricks. Overall, the check is prone to false negatives due to the lack of canonical path comparison.
Activity
wleese commentedon Mar 31, 2026
Will 3.6.1 be released to fix this issue?
toby1984 commentedon Apr 10, 2026
Just as a side note, this rabbit hole goes deep - a plethora of Maven plugins are using vulnerable versions of plexus-utils (not saying those are actually using the impacted code path though) and will all need to do a new release.
One of our projects (~50 Maven modules, 600 kloc) shows the following dependencies (gathered by massaging "mvn dependency:resolve-plugins" output, build using Apache Maven 3.9.14):
org.apache.maven.plugins:maven-surefire-plugin:maven-plugin:3.1.2:runtime -> plexus-utils:3.5.0
org.apache.maven.plugins:maven-install-plugin:maven-plugin:3.1.1:runtime -> plexus-utils:3.5.0
org.apache.maven.plugins:maven-war-plugin:maven-plugin:3.4.0:runtime -> plexus-utils:3.5.1
org.apache.maven.plugins:maven-site-plugin:maven-plugin:4.0.0-M10:runtime -> plexus-utils:3.5.1
org.apache.maven.plugins:maven-jar-plugin:maven-plugin:3.3.0:runtime -> plexus-utils:3.4.2
org.apache.maven.plugins:maven-enforcer-plugin:maven-plugin:3.4.1:runtime -> plexus-utils:3.5.1
org.apache.maven.plugins:maven-clean-plugin:maven-plugin:3.3.1:runtime -> plexus-utils:4.0.0
org.apache.maven.plugins:maven-deploy-plugin:maven-plugin:3.1.1:runtime -> plexus-utils:3.5.0
org.apache.maven.plugins:maven-compiler-plugin:maven-plugin:3.11.0:runtime -> plexus-utils:3.5.0
org.apache.maven.plugins:maven-resources-plugin:maven-plugin:3.3.1:runtime -> plexus-utils:3.5.1
org.apache.maven.plugins:maven-dependency-plugin:maven-plugin:3.6.0:runtime -> plexus-utils:3.5.1
org.codehaus.mojo:jaxws-maven-plugin:maven-plugin:2.6:runtime -> plexus-utils:3.2.1
org.jvnet.jaxb2.maven2:maven-jaxb2-plugin:maven-plugin:0.13.3:runtime -> plexus-utils:1.5.15
com.alexnederlof:jasperreports-plugin:maven-plugin:2.8:runtime -> plexus-utils:3.2.1
org.codehaus.mojo:buildnumber-maven-plugin:maven-plugin:3.2.0:runtime -> plexus-utils:3.5.1
org.apache.maven.plugins:maven-assembly-plugin:maven-plugin:3.6.0:runtime -> plexus-utils:3.5.1
Even after upgrading/pinning all of those plugins to their latest releases (using in our pom.xml) they still only depend on vulnerable version.
slawekjaranowski commentedon Apr 10, 2026
@toby1984 thanks, should be reported plugin by plugin .... after check in not updated ....
I will try to release Apache Maven plugins ... in this month
toby1984 commentedon Apr 14, 2026
Thank you ! FWIW, I ran a very crude check (just grep for imports of org.codehaus.plexus.util.Expand) across a limited set of Maven core plugins (the ones our product is using during build time) and could find NO usages.
These are the GIT tags and plugins I checked: