CVE-2023-40827

CVE-2023-40827 concerns the Plugin Framework for Java (PF4J) before 3.9.1, where a remote attacker can abuse the loadpluginPath parameter to obtain sensitive information and execute arbitrary code. Connected docs corroborate: PF4J v3.9.0 and earlier are affected; exploitation involves crafted arc...

CVE-2023-40826

PF4J (Plugin Framework for Java) v3.9.0 and earlier is affected by CVE-2023-40826, where improper input validation in the zippluginPath handling can allow a remote attacker to obtain sensitive information and execute arbitrary code via a crafted archive. The issue is referenced across multiple fe...

CVE-2023-40828

PF4J (Plugin Framework for Java) v3.9.0 and earlier is affected by CVE-2023-40828 due to improper input validation in the expandIfZip function of extract, enabling a remote attacker to obtain sensitive information and execute arbitrary code. Exploitation involves crafting an archive with dot-dot ...

CVE-2025-70952

pf4j (up to version before 20c2f80) contains a path traversal/Zip Slip vulnerability in Unzip.java: extract() mishandles zip entry names due to missing path normalization and validation. This can enable directory traversal and unauthorized file write. Affected component is the unzip logic; impact...