CVE-2023-37460 in Plexus Archiver
Summary
by MITRE • 07/25/2023
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/24/2025
The vulnerability described in CVE-2023-37460 affects Plexis Archiver, a collection of Plexus components designed for creating and extracting archives through a unified Archiver/UnArchiver API. This security flaw exists in versions prior to 4.8.0 and represents a critical path traversal vulnerability that could enable arbitrary file creation and potentially remote code execution. The issue specifically impacts the AbstractUnArchiver component during archive extraction operations, making it a significant concern for any system that processes untrusted archive files.
The technical root cause of this vulnerability lies within the `resolveFile()` function implementation within the AbstractUnArchiver class. When processing archive entries that correspond to symbolic links already present in the destination directory, the function incorrectly returns the symbolic link's source path rather than resolving it to the actual target path. This misbehavior occurs specifically when the symbolic link points to a non-existent target file. The flawed logic bypasses the intended security check that verifies archive entries will not be extracted outside the designated destination directory, creating a window of opportunity for malicious exploitation. This behavior directly violates the principle of least privilege and proper path validation that should prevent directory traversal attacks.
The operational impact of this vulnerability extends beyond simple file creation to potentially enable remote code execution when combined with other attack vectors. When the system attempts to extract archive contents using `Files.newOutputStream()` which follows symbolic links by default, the actual file content gets written to the symbolic link's target file rather than the intended location. This means an attacker could craft a malicious archive containing symbolic links pointing to critical system files such as /etc/passwd or system binaries, resulting in unauthorized modifications to sensitive system resources. The vulnerability affects any application or service that relies on Plexis Archiver for processing untrusted archive files, including web applications, automated build systems, and file processing services.
This vulnerability maps directly to CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path) within the CWE taxonomy, representing a classic case of improper input validation that allows attackers to manipulate file paths. From an ATT&CK framework perspective, this vulnerability aligns with T1059.007 (Command and Scripting Interpreter: JavaScript) and T1566 (Phishing) as it could enable an attacker to place malicious payloads in system directories. The attack chain typically involves an attacker uploading a malicious archive containing carefully crafted symbolic links, which when processed by vulnerable systems, results in unauthorized file creation. Organizations using Plexis Archiver in their infrastructure should immediately upgrade to version 4.8.0 or later, which includes the necessary patch to address the symbolic link resolution issue. Additionally, implementing proper input validation, restricting archive extraction permissions, and monitoring for unusual file creation patterns can serve as supplementary defensive measures against potential exploitation attempts.