{"id":"CVE-2025-70952","details":"pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.","aliases":["GHSA-5458-7hh9-v7p4"],"modified":"2026-08-12T15:14:58.016238Z","published":"2026-03-25T00:00:00Z","related":["CGA-hj9h-9239-q2wg"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70952.json","unresolved_ranges":[{"extracted_events":[{"introduced":"pf4j"},{"fixed":"20c2f80"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70952.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70952"},{"type":"REPORT","url":"https://github.com/pf4j/pf4j/issues/618"},{"type":"REPORT","url":"https://github.com/pf4j/pf4j/issues/623"},{"type":"FIX","url":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pf4j/pf4j","events":[{"introduced":"0"},{"fixed":"6bfa9e87d673a1023b6b4c7ed01d2652467d4a0e"},{"fixed":"20c2f80089d1ea779e22c2de5f109a0bce4e1b14"}],"database_specific":{"cpe":"cpe:2.3:a:pf4j_project:pf4j:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.14.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["release-3.14.0","release-3.13.0","release-3.12.1","release-3.12.0","release-3.11.1","release-3.11.0","release-3.10.0","release-3.9.0","release-3.8.0","release-3.7.0","release-3.6.0","release-3.5.0","release-3.4.1","release-3.4.0","release-3.3.1","release-3.3.0","release-3.2.0","release-3.1.0","release-3.0.1","release-3.0.0","release-2.6.0","release-2.5.0","release-2.4.0","release-2.3.0","release-2.2.0","release-2.1.0","release-2.0.0","release-1.3.0","release-1.2.0","release-1.1.0","release-1.0.0","release-0.13.1","release-0.13.0","release-0.12.0","release-0.11.0","release-0.10.0","release-0.9.0","release-0.7.1","release-0.7.0","release-0.3","release-0.2","release-0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70952.json","vanir_signatures_modified":"2026-08-12T15:14:58Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14","target":{"file":"pf4j/src/main/java/org/pf4j/util/Unzip.java","function":"extract"},"deprecated":false,"digest":{"length":1011,"function_hash":"253057656720980051171116464833318622413"},"id":"CVE-2025-70952-1f6babde"},{"source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14","target":{"file":"pf4j/src/main/java/module-info.java"},"deprecated":false,"digest":{"line_hashes":["256001070061343481858270498874984267146","227782772851238445579653647503076655356","323697229540984549511580650023475231899","90877395449385225515031197398092003800","278221398673693210312615913745845636195","183820035221782670768511872410962893925"],"threshold":0.9},"id":"CVE-2025-70952-419d1123","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"237090949863444508017308368234914472565","length":389},"id":"CVE-2025-70952-59773be3","signature_type":"Function","signature_version":"v1","source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14","target":{"file":"pf4j/src/test/java/org/pf4j/util/UnzipTest.java","function":"createMaliciousZipFile"}},{"deprecated":false,"digest":{"line_hashes":["171444151610414376169025138311160781884","17862288441120938289186277816305460977","317487300280540671116132564149158928197","13100310458176886895497552212336934162","243097082900672314807692765700979873810","76740222291344701530372902407297795141","55979515125495199922207159585312026318","3475553176018127277104620368359700805","188387110822814031866990973580258874114","172025312303737851897134609223214976561","208787153944094720582174278084095764495","289577955964086845752602735824572019244","142995542566173887383596354845276332261","116249538268061424828673859167298288225","28013072966596356403481590611578683258","301870869692998657074686892099287595625","69123628957505696631708598921152657664","288319528762119932998504260960124657727","189186283645988486573226202906626782203"],"threshold":0.9},"id":"CVE-2025-70952-5f6e544e","signature_type":"Line","signature_version":"v1","source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14","target":{"file":"pf4j/src/main/java/org/pf4j/util/Unzip.java"}},{"source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14","target":{"file":"pf4j/src/test/java/org/pf4j/util/UnzipTest.java","function":"zipSlip"},"deprecated":false,"digest":{"function_hash":"56402618767251861640903557912081446268","length":362},"id":"CVE-2025-70952-94b877c5","signature_type":"Function","signature_version":"v1"},{"target":{"file":"pf4j/src/test/java/org/pf4j/util/UnzipTest.java"},"deprecated":false,"digest":{"line_hashes":["64706012557220039395780267090851691857","41583390673326685001982352233348259564","304229133156415490843266377955443778356","231874775262152187627481872769280813847","15033450737081878184934422295811637871","203093042409316608141538743001622867994","21302151147656012257120660422701802926","334475296513030544086183727315743699247","14935062281343620622037640760017285112","67906798423014549328165995561586858863","122081789489064191759254149295382610041","309027612789748892557890844624512187952","5999120656859378079634142338892070139","319672512529121040334378601665620174908"],"threshold":0.9},"id":"CVE-2025-70952-9da21be9","signature_type":"Line","signature_version":"v1","source":"https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}