CVE-2025-27553CWE-23

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

High · published March 23, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that

takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of

the base file". However, when the path contains encoded ".."

characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not

a descendent of the base file, without throwing an exception.

This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01425 · 72.7th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2025-03-23T14:16Z
EPSS history
Timeline
  • 23 MAR 14:16Z
    Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT
    cvelistv5