EUVD-2025-209006
GHSA-5458-7hh9-v7p4
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Tags
Description
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
Analysis
pf4j versions prior to commit 20c2f80 contain a Zip Slip path traversal vulnerability in the Unzip.java extract() function that fails to properly validate and normalize zip entry names, allowing attackers to write files outside the intended extraction directory. An attacker can craft a malicious zip file with directory traversal sequences (e.g., ../../../) in entry names to extract arbitrary files to unauthorized locations on the system. This vulnerability affects the pf4j plugin framework, which is widely used in Java applications that dynamically load plugins; a proof-of-concept has been documented on GitHub (weaver4VD gist), indicating functional exploitation is possible.
Technical Context
pf4j is a lightweight Java plugin framework that manages plugin discovery, loading, and execution. The vulnerability resides in the Unzip.java utility class, specifically the extract() method responsible for decompressing plugin archives. The root cause is improper handling of zip entry names as defined in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Zip Slip). When processing ZipEntry objects, the code does not canonicalize file paths or validate that extracted entries remain within the intended destination directory. Attackers can bypass directory restrictions by including path traversal sequences (../) or absolute paths in zip entry names, a well-known attack pattern documented since the 2018 Zip Slip disclosure. The vulnerability affects pf4j framework versions before the patched commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14.
Affected Products
pf4j (no vendor specified in CPE data, generic package reference available) versions prior to commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14 are affected. The exact version number is not provided in public disclosures, but the patch commit directly references the fix. Any Java application embedding pf4j for plugin management is affected if running an unpatched version. The vulnerability was discussed in GitHub issues #618 and #623 within the pf4j project repository (https://github.com/pf4j/pf4j), which serve as the primary advisory source. Organizations using pf4j should check their specific version against the patched commit to determine exposure.
Remediation
Upgrade pf4j to a version incorporating commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14 or later. Refer to the official pf4j GitHub repository commit history (https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14) to identify the exact patched release version. As an interim workaround, restrict plugin installation to digitally signed archives from trusted sources, enforce file integrity checks on extracted plugin contents, and validate that all extracted files reside within the intended plugin directory using canonical path comparison (e.g., Java's File.getCanonicalPath()). Additionally, run plugin loading in a sandboxed environment with minimal file system permissions to limit blast radius.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today