CVE-2025-70952

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

• CWE-22

• https://gist.github.com/weaver4VD/410f23adb24ef5f5077f021f4393e705Third Party Advisory
• https://github.com/pf4j/pf4j/commit/20c2f80089d1ea779e22c2de5f109a0bce4e1b14Patch
• https://github.com/pf4j/pf4j/issues/618Issue Tracking, Third Party Advisory
• https://github.com/pf4j/pf4j/issues/623Exploit, Issue Tracking, Third Party Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-70936Vtiger CRM 8.4.0 contains a reflected cross-site scripting (…5.4
• CVE-2025-7094A vulnerability was found in Belkin F9K1122 1.00.33. It has …8.8
• CVE-2025-70948A host header injection vulnerability in the mailer componen…9.3
• CVE-2025-70949An observable timing discrepancy in @perfood/couch-auth v0.2…7.5
• CVE-2025-7095A vulnerability classified as critical has been found in Com…6.1
• CVE-2025-70950An issue in gohttp commit 34ea51 allows attackers to execute…7.3
• CVE-2025-70954A Null Pointer Dereference vulnerability exists in the TON V…7.5
• CVE-2025-70955A Stack Overflow vulnerability was discovered in the TON Vir…7.5
• CVE-2025-70956A State Pollution vulnerability was discovered in the TON Vi…7.5
• CVE-2025-70957A Denial of Service (DoS) vulnerability was discovered in th…7.5
• CVE-2025-70958Multiple reflected cross-site scripting (XSS) vulnerabilitie…6.1
• CVE-2025-70959A stored cross-site scripting (XSS) vulnerability in the Job…5.4