CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
- Affected products
- Alt Linux, Apache Commons Io, Astra Linux, Linuxmint, Oracle Weblogic Server, Suse, Ubuntu
- Apache Commons Io
- = 2.2, 2.3, 2.4, 2.5, 2.6
- Fix
- Available
- CVSS 2.0
- 5.8 MEDIUM
- CVSS 3.1
- 4.8 MEDIUM
- EPSS
- 10.2% (95th percentile)
- Weakness
- CWE-20, CWE-22
- NVD status
- Modified
- Published
- 2021-04-13
Workaround
Neither the method in question (FileNameUtils.normalize) nor any methods, that invoke it, do actually access any files. There's only a string returned, from which a path can be constructed. In other words, a possible workaround would be not passing any unsafe input to FileNameUtils.normalize. Upgrade to Apache Commons IO 2.7, or later, where the same method returns the value null, as an indication of "invalid input".
No indexed exploits for CVE-2021-29425 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-29425 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.