Skip to content
OpenAdvisories
Medium USN-5095-1 1 CVE

commons-io vulnerability

Published Sep 29, 2021 · Updated Oct 8, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Commons IO incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS commons-io 2.6-2ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS commons-io 2.6-2ubuntu0.20.04.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2021-29425