Skip to content
OpenAdvisories
Medium DLA-2741-1 1 CVE

commons-io - security update

Published Aug 12, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 commons-io 2.5-1+deb9u1

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io Debian Ubuntu Wolfi Maven