anonhaven
Ad

CVE-2025-70952

NONE
Updated Mar 25, 2026
Java
Parameter Value
Affected Versions before 20
Vendor Java
Public PoC No

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

References 4

https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705
cve@mitre.org
https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14
cve@mitre.org
https://github.com/pf4j/pf4j/issues/618
cve@mitre.org
https://github.com/pf4j/pf4j/issues/623
cve@mitre.org
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-32948

Java

6.7

CVE-2026-4741

Java

8.6

CVE-2026-4735

Java

8.7

CVE-2026-4597

Java

5.3

CVE-2026-4594

Java

6.9