Pf4j

pf4j

Vendor: Pf4j Project • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-70952 1Pf4j Project 1Pf4j Jun 17, 2026 Mar 25, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path n...Show more pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.Show less
CVE-2023-40828 1Pf4j Project 1Pf4j Jun 17, 2026 Aug 28, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
CVE-2023-40827 1Pf4j Project 1Pf4j Jun 17, 2026 Aug 28, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
CVE-2023-40826 1Pf4j Project 1Pf4j Jun 17, 2026 Aug 28, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.