Codehaus Plexus

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Codehaus Plexus product.

RSS Feeds for Codehaus Plexus security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Codehaus Plexus products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Codehaus Plexus Sorted by Most Security Vulnerabilities since 2018

Codehaus Plexus Plexus Utils3 vulnerabilities

Codehaus Plexus Plexus Archiver2 vulnerabilities

By the Year

In 2026 there have been 0 vulnerabilities in Codehaus Plexus. Codehaus Plexus did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	0	0.00
2023	3	7.20
2022	0	0.00
2021	0	0.00
2020	0	0.00
2019	0	0.00
2018	2	7.65

It may take a day or so for new Codehaus Plexus vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Codehaus Plexus Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2022-4245	Sep 25, 2023	XML Injection via --> in Codehaus Plexus XmlWriterUtil A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.	Plexus Utils
CVE-2022-4244	Sep 25, 2023	Dir Trav in Codeplex Codehaus Repo A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.	Plexus Utils
CVE-2023-37460	Jul 25, 2023	Plexus Archiver 4.8.0: Arbitrary file creation via symlink extraction Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.	Plexus Archiver
CVE-2018-1002200	Jul 25, 2018	plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.	Plexus Archiver
CVE-2017-1000487	Jan 03, 2018	Plexus-utils before 3.0.16 is vulnerable to command injection Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.	Plexus Utils