CVE-2025-27553

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Relative Path Traversal pada apache commons vfs. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Rincian

Terbit di NVD

23 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/03/23/1 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/04/msg00006.html