Description
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-fileupload-java | 1.3-1 | — |
| Debian 13 | libcommons-fileupload-java | 1.3-1 | — |
| Debian 12 | libcommons-fileupload-java | 1.3-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | >= 1.0, < 1.2.2 | 1.2.2 | GHSA-vm69-474v-7q2w |
Advisories 1
- WID-SEC-2026-0915 Kyocera Drucker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
References
- 58326 vdb-entry
- HPSBMU03409 vendor-advisory
- 20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples mailing-list
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- 90906 vdb-entry
- GLSA-202107-39 vendor-advisory