pf4j versions before commit 20c2f800 contain a path‑traversal vulnerability in the Unzip.extract method. Improper handling of zip entry names allows a malicious archive to write files outside the intended extraction directory, potentially overwriting existing files or placing files in arbitrary locations. This weakness is identified as CWE‑22 and is quantified with a CVSS v3.1 score of 7.5, indicating high severity.

The vulnerability affects all releases of the pf4j framework that use the Unzip helper prior to commit 20c2f800. Applications or services that employ pf4j for plugin or extension installation and rely on its unzip functionality for handling ZIP archives are at risk. Versions newer than this commit are not affected.

The EPSS score is below 1 %, and the vulnerability is not included in CISA’s KEV catalog, suggesting a low current exploitation probability. The likely attack vector is when an attacker can supply a malicious ZIP file to a component that invokes pf4j’s unzip logic, such as during plugin upload or extension installation. The exploit would require write access to the base extraction directory; success could allow modification of the file system as the application runs.