Back to CVE records
Medium 6.5HealthcarePublished Apr 13, 2021
CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Commons IO and 59 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 10.55%, higher than 96% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
- CVSS
- 6.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 10.55% (percentile 96)
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Commons IO apache_software_foundation:apache_commons_io (from the name) | Apache Commons IO 2.2; Apache Commons IO 2.3; Apache Commons IO 2.4; Apache Commons IO 2.5; Apache Commons IO 2.6 | CNA record |
apache commons_io apache:commons_io | 2.2; 2.3; 2.4; 2.5; 2.6 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
oracle access_manager oracle:access_manager | 11.1.2.3.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.6 | NVD |
oracle application_performance_management oracle:application_performance_management | 13.4.1.0; 13.5.1.0 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle banking_apis oracle:banking_apis | 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; 21.1 | NVD |
oracle banking_digital_experience oracle:banking_digital_experience | 17.2; 18.1; 18.3; 19.1; 19.2; 20.1; 21.1 | NVD |
oracle banking_enterprise_default_management oracle:banking_enterprise_default_management | 2.6.2; 2.7.0; 2.7.1; 2.10.0; 2.12.0 | NVD |
oracle banking_enterprise_default_managment oracle:banking_enterprise_default_managment | from 2.3.0 through 2.4.0 | NVD |
oracle banking_party_management oracle:banking_party_management | 2.7.0 | NVD |
oracle banking_platform oracle:banking_platform | from 2.3.0 through 2.4.1; 2.6.2; 2.7.0; 2.7.1 | NVD |
oracle blockchain_platform oracle:blockchain_platform | before 21.1.2 | NVD |
oracle commerce_guided_search oracle:commerce_guided_search | 11.3.2 | NVD |
oracle communications_application_session_controller oracle:communications_application_session_controller | 3.9.0 | NVD |
oracle communications_billing_and_revenue_management_elastic_charging_engine oracle:communications_billing_and_revenue_management_elastic_charging_engine | 11.3; 12.0 | NVD |
oracle communications_cloud_native_core_network_repository_function oracle:communications_cloud_native_core_network_repository_function | 1.14.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.14.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.4.0 | NVD |
oracle communications_contacts_server oracle:communications_contacts_server | 8.0.0.6.0 | NVD |
oracle communications_converged_application_server_-_service_controller oracle:communications_converged_application_server_-_service_controller | 6.2 | NVD |
oracle communications_convergence oracle:communications_convergence | 3.0.2.2.0 | NVD |
oracle communications_design_studio oracle:communications_design_studio | from 7.4.0 through 7.4.2; 7.3.5 | NVD |
oracle communications_diameter_intelligence_hub oracle:communications_diameter_intelligence_hub | from 8.0.0 through 8.1.0; from 8.2.0 through 8.2.3 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | 6.3; 6.4 | NVD |
oracle communications_offline_mediation_controller oracle:communications_offline_mediation_controller | 12.0.0.3 | NVD |
oracle communications_order_and_service_management oracle:communications_order_and_service_management | 7.3; 7.4 | NVD |
oracle communications_policy_management oracle:communications_policy_management | 12.5.0.0.0 | NVD |
oracle communications_pricing_design_center oracle:communications_pricing_design_center | 12.0.0.4.0; 12.0.0.5.0 | NVD |
oracle communications_service_broker oracle:communications_service_broker | 6.2 | NVD |
oracle enterprise_communications_broker oracle:enterprise_communications_broker | 3.3 | NVD |
oracle enterprise_session_border_controller oracle:enterprise_session_border_controller | 8.4; 9.0 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.7 through 8.1.1 | NVD |
oracle financial_services_model_management_and_governance oracle:financial_services_model_management_and_governance | from 8.0.8 through 8.1.1 | NVD |
oracle flexcube_core_banking oracle:flexcube_core_banking | from 11.6.0 through 11.8.0; 5.2.0; 11.10.0 | NVD |
oracle fusion_middleware_mapviewer oracle:fusion_middleware_mapviewer | 12.2.1.4.0 | NVD |
oracle health_sciences_data_management_workbench oracle:health_sciences_data_management_workbench | 2.5.2.1; 3.0.0.0 | NVD |
oracle health_sciences_information_manager oracle:health_sciences_information_manager | from 3.0.1 through 3.0.4 | NVD |
oracle healthcare_data_repository oracle:healthcare_data_repository | 8.1.0 | NVD |
oracle helidon oracle:helidon | 1.4.7; 2.2.0 | NVD |
oracle insurance_policy_administration oracle:insurance_policy_administration | 11.0.2; 11.1.0; 11.2.8; 11.3.0; 11.3.1 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 11.0.2; 11.1.0; 11.2.8; 11.3.0; 11.3.1 | NVD |
oracle oss_support_tools oracle:oss_support_tools | before 2.12.42 | NVD |
oracle primavera_unifier oracle:primavera_unifier | from 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 | NVD |
oracle real_user_experience_insight oracle:real_user_experience_insight | 13.4.1.0; 13.5.1.0 | NVD |
oracle rest_data_services oracle:rest_data_services | before 21.2; 21.3 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 16.0.3 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | from 16.0.1 through 16.0.3; 13.0; 14.1.3.0; 14.1.3.2; 15.0.3.1; 19.0.0; 19.0.1 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 16.0.3; 19.0.1 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 16.0; 18.0; 19.1 | NVD |
oracle retail_pricing oracle:retail_pricing | 19.0.1 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | from 16.0.1 through 16.0.3; 14.1.3.0; 14.1.3.2; 15.0.3.1; 19.0.0; 19.0.1 | NVD |
oracle retail_size_profile_optimization oracle:retail_size_profile_optimization | 16.0.3 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 17.0.4; 18.0.3; 19.0.2; 20.0.1 | NVD |
oracle solaris_cluster oracle:solaris_cluster | 4.0 | NVD |
oracle utilities_testing_accelerator oracle:utilities_testing_accelerator | 6.0.0.1.1; 6.0.0.2.2; 6.0.0.3.1 | NVD |
oracle webcenter_portal oracle:webcenter_portal | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 | NVD |
References
- https://issues.apache.org/jira/browse/IO-556x-refsource-misc, exploit, issue-tracking, vendor-advisory
- https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3Ex-refsource-misc
- https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a%40%3Cuser.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa%40%3Cuser.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0%40%3Cpluto-dev.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80%40%3Cpluto-dev.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374%40%3Cnotifications.zookeeper.apache.org%3E
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.