What is GHSA-5458-7hh9-v7p4?

GHSA-5458-7hh9-v7p4 is a security advisory published by GitHub Security Advisories with High severity. pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

Which CVE IDs does GHSA-5458-7hh9-v7p4 cover?

GHSA-5458-7hh9-v7p4 covers the following CVE IDs: CVE-2025-70952. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5458-7hh9-v7p4?

GHSA-5458-7hh9-v7p4 affects 1 product, including: maven/org.pf4j:pf4j:\u003c 3.14.1.

GHSA-5458-7hh9-v7p4High

pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

Vendor

GitHub Security Advisories

Published

March 25, 2026

Last Modified

March 27, 2026

🔗 CVE IDs covered (1)

CVE-2025-70952 →

📋 Description

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

🎯 Affected products1

maven/org.pf4j:pf4j:< 3.14.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-70952
https://github.com/pf4j/pf4j/issues/618
https://github.com/pf4j/pf4j/issues/623
https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14
https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705
https://github.com/advisories/GHSA-5458-7hh9-v7p4