CVE-2025-70952 vulnerabilities

Vulnerabilities for packages: nextflow, kayenta-fips, kayenta...

org.pf4j:pf4j-spring (0.5.0) potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.3.0)

org.pf4j:pf4j MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.5.0 Source cves: CVE-2025-70952 Source advisory: OSV:GHSA-5458-7HH9-V7P4...

com.gitee.starblues:springboot-plugin-framework (>=1.0-release, <=2.1.4-release), com.gitee.starblues:springboot-plugin-framework-extension-mybatis (>=2.0-release, <=2.1.4-release) +36 more potentially affected by CVE-2025-70952 via org.pf4j:pf4j (2.6.0)

org.pf4j:pf4j MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.gitee.starblues:springboot-plugin-framework =1.0-release, =2.0-release, =1.0.8.release, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0,...

CVE-2025-70952

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...