High DLA-4111-1 1 CVE

commons-vfs - security update

Published Apr 2, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	commons-vfs	2.1-2+deb11u1

Vulnerabilities 1

High 7.5

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

Apache Software Foundation Apache Commons VFS commons-vfs org.apache.commons:commons-vfs2 Debian Ubuntu Maven

Mar 23, 2025