Package · Debian

commons-vfs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 7.5

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

Apache Software Foundation Apache Commons VFS org.apache.commons:commons-vfs2 commons-vfs Debian Ubuntu Maven

Mar 23, 2025
Medium 5.0

CVE-2025-30474

Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mas…

Apache Software Foundation Apache Commons VFS commons-vfs org.apache.commons:commons-vfs2 Debian Ubuntu Maven

Mar 23, 2025