CVE-2025-27553
Description
Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.
How to fix
- apache commons_vfs2.10.0 or later
- org.apache.commons:commons-vfs22.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache commons_vfs | v < 2.10.0 | 2.10.0 |
| org.apache.commons:commons-vfs2Maven | v < 2.10.0 | 2.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.