GHSA-gwrp-pvrq-jmwvMediumCVSS 4.8

Path Traversal and Improper Input Validation in Apache Commons IO

Published
April 26, 2021
Last Modified
February 14, 2024

🔗 CVE IDs covered (1)

CVE-2021-29425 →

📋 Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

🎯 Affected products10

  • maven/commons-io:commons-io:< 2.7
  • maven/com.cosium.vet:vet:>= 1.0, <= 3.22
  • maven/com.diamondq.common:common-thirdparty.jcasbin:= 1.4.0
  • maven/com.liferay:com.liferay.sass.compiler.jsass:= 1.0.1
  • maven/com.virjar:ratel-api:>= 1.0.0, <= 1.3.6
  • maven/net.hasor:cobble-lang:>= 4.4.1, <= 4.6.2
  • maven/org.apache.commons:commons-io:= 1.3.2
  • maven/org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io:>= 1.4, <= 1.5
  • maven/org.checkerframework.annotatedlib:commons-io:>= 2.6, < 2.7
  • maven/org.smartboot.servlet:servlet-core:>= 0.1.9, <= 0.6

🔗 References (51)