Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.
The FileObject API in Commons VFS has a 'resolveFile' method that
takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of
the base file". However, when the path contains encoded ".."
characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not
a descendent of the base file, without throwing an exception.
This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/03/23/1 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb | Mailing List Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2025/04/msg00006.html |
Configurations
History
02 Apr 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Mar 2025, 15:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache commons Vfs
Apache |
|
| References | () http://www.openwall.com/lists/oss-security/2025/03/23/1 - Mailing List, Third Party Advisory | |
| References | () https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb - Mailing List, Vendor Advisory | |
| CPE | cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:* |
23 Mar 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE |
23 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-23 15:15
Updated : 2025-04-02 22:15
NVD link : CVE-2025-27553
Mitre link : CVE-2025-27553
JSON object : View
Products Affected
apache
- commons_vfs
CWE
No CWE.