What is the CVSS score of EUVD-2025-209006?

EUVD-2025-209006 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of N A are affected by EUVD-2025-209006?

Organizations using pf4j before 20c2f80 face notable risk from CVE-2025-70952, a path traversal vulnerability rated CVSS 7.5.. A patch is available.

How to fix or mitigate EUVD-2025-209006?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

N A EUVD-2025-209006

| CVE-2025-70952 HIGH

Path Traversal (CWE-22)

2026-03-25 mitre

GHSA-5458-7hh9-v7p4

Path Traversal N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 18:47 euvd

EUVD-2025-209006

Analysis Generated

Mar 25, 2026 - 18:47 vuln.today

CVE Published

Mar 25, 2026 - 00:00 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

270 maven packages depend on org.pf4j:pf4j (8 direct, 262 indirect)

Ecosystem-wide dependent count for version 3.14.1.

DescriptionCVE.org

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

AnalysisAI

pf4j versions prior to commit 20c2f80 contain a Zip Slip path traversal vulnerability in the Unzip.java extract() function that fails to properly validate and normalize zip entry names, allowing attackers to write files outside the intended extraction directory. An attacker can craft a malicious zip file with directory traversal sequences (e.g., ../../../) in entry names to extract arbitrary files to unauthorized locations on the system. This vulnerability affects the pf4j plugin framework, which is widely used in Java applications that dynamically load plugins; a proof-of-concept has been documented on GitHub (weaver4VD gist), indicating functional exploitation is possible.

Technical ContextAI

pf4j is a lightweight Java plugin framework that manages plugin discovery, loading, and execution. The vulnerability resides in the Unzip.java utility class, specifically the extract() method responsible for decompressing plugin archives. The root cause is improper handling of zip entry names as defined in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Zip Slip). When processing ZipEntry objects, the code does not canonicalize file paths or validate that extracted entries remain within the intended destination directory. Attackers can bypass directory restrictions by including path traversal sequences (../) or absolute paths in zip entry names, a well-known attack pattern documented since the 2018 Zip Slip disclosure. The vulnerability affects pf4j framework versions before the patched commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14.

RemediationAI

Upgrade pf4j to a version incorporating commit 20c2f80089d1ea779e22c2de5f109a0bce4e1b14 or later. Refer to the official pf4j GitHub repository commit history (https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14) to identify the exact patched release version. As an interim workaround, restrict plugin installation to digitally signed archives from trusted sources, enforce file integrity checks on extracted plugin contents, and validate that all extracted files reside within the intended plugin directory using canonical path comparison (e.g., Java's File.getCanonicalPath()). Additionally, run plugin loading in a sandboxed environment with minimal file system permissions to limit blast radius.