Medium ELSA-2025-10548 1 CVE

Moderate: apache-commons-vfs security update (Oracle Linux 7)

Published Jul 23, 2025 · Updated Jul 23, 2025

Ecosystem: Oracle Linux

Summary

[2.0-11.0.1]
- Simplify UriParser [Orabug: 38161936][CVE-2025-27553]

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 7	apache-commons-vfs	0:2.0-11.0.1.el7
Oracle Linux · 7	apache-commons-vfs-ant	0:2.0-11.0.1.el7
Oracle Linux · 7	apache-commons-vfs-examples	0:2.0-11.0.1.el7
Oracle Linux · 7	apache-commons-vfs-javadoc	0:2.0-11.0.1.el7

Vulnerabilities 1

High 7.5

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

Apache Software Foundation Apache Commons VFS commons-vfs org.apache.commons:commons-vfs2 Debian Ubuntu Maven

Mar 23, 2025