Skip to content
OpenAdvisories
Unscored DSA-2827-1 1 CVE

libcommons-fileupload-java - arbitrary file upload via deserialization

Published Dec 24, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 6.0 libcommons-fileupload-java 1.2.2-1+deb6u1
Debian · 7 libcommons-fileupload-java 1.2.2-1+deb7u1

Vulnerabilities 1

  • High —
    CVE-2013-2186 Public exploit EPSS 13%

    Arbitrary file write in Apache Commons Fileupload

    The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a seria…

    commons-fileupload:commons-fileupload libcommons-fileupload-java Debian Maven