Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2021-29425

Possible limited path traversal vulnerabily in Apache Commons IO

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Commons IO

  • Apache Commons IO 2.2affected
  • Apache Commons IO 2.3affected
  • Apache Commons IO 2.4affected
  • Apache Commons IO 2.5affected
  • Apache Commons IO 2.6affected

References