Skip to content
Fencer Vulns
medium 6.5

CVE-2021-29425 json

Possible limited path traversal vulnerabily in Apache Commons IO

published 2021-04-13 5 y ago modified 2026-10-07 32 d ago also GHSA-gwrp-pvrq-jmwv , EUVD-2021-0828

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
10.5%
EPSS 10.5% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Patch / fix

  • maven commons-io:commons-io 2.7
  • maven org.checkerframework.annotatedlib:commons-io 2.7
  • oracle blockchain_platform 21.1.2
  • oracle oss_support_tools 2.12.42
  • oracle rest_data_services 21.2
  • commons-io Debian 14, Debian 13, Debian 12 2.8.0-1

debian advisories DEBIAN-CVE-2021-29425

  • commons-io Ubuntu 18.04 LTS 2.6-2ubuntu0.18.04.1
  • commons-io Ubuntu 20.04 LTS 2.6-2ubuntu0.20.04.1
  • commons-io Ubuntu Pro 14.04 LTS 2.4-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-29425

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform 7.4 4.1.63-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.1-2.GA_redhat_00003.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.9-2.SP1_redhat_00001.1.el8eap
  • eap7-velocity jboss enterprise application platform 7.4 2.3.0-1.redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.63-1.Final_redhat_00001.1.el8eap
  • eap7-jakarta-el jboss enterprise application platform 7.4, jboss enterprise application platform 7.3 3.0.3-2.redhat_00006.1.el8eap
  • eap7-wildfly-elytron jboss enterprise application platform 7.4 1.15.5-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly-modules jboss enterprise application platform 7.4 7.4.1-2.GA_redhat_00003.1.el8eap

red hat advisories RHSA-2021:3658RHSA-2021:3656RHSA-2021:3466RHSA-2021:3468RHSA-2021:3467

  • apache-commons-io SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 2.4-9.3.1
  • apache-commons-io SLE Module for Basesystem 15 SP2 2.6-3.3.1

suse advisories SUSE-SU-2021:1315-1SUSE-SU-2021:1282-1

  • apache-commons-io openSUSE Tumbleweed 2.11.0-2.1
  • apache-commons-io openSUSE Leap 15.2 2.6-lp152.2.3.1

opensuse advisories openSUSE-SU-2024:12099-1openSUSE-SU-2021:0605-1

  • java-commons-io Arch Linux 2.8.0-1

arch linux advisories AVG-1805

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-29425 updated cvss 4.8

apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

  • Red Hat A-MQ Clients 2 commons-io
    affected: no fix planned “Will not fix”
  • Red Hat BPM Suite 6 commons-io
    affected: no fix planned “Out of support scope”
  • Red Hat Data Grid 8 commons-io
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 apache-commons-io, apache-commons-io-javadoc Red Hat JBoss A-MQ 6 commons-io Red Hat JBoss BRMS 6 commons-io Red Hat JBoss Data Grid 7 commons-io Red Hat JBoss Data Virtualization 6 commons-io Red Hat JBoss Enterprise Application Platform 6 commons-io
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack commons-io
    affected: no fix available
  • Red Hat JBoss Fuse 6 commons-io Red Hat JBoss Fuse Service Works 6 commons-io
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes commons-io Red Hat Software Collections rh-maven36-apache-commons-io, rh-maven36-apache-commons-io-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat EAP 7.3.9 release
    fixed: vendor fix RHSA-2021:3471
show 15 more
  • Red Hat AMQ 7.9.0
    fixed: vendor fix RHSA-2021:3700
  • Red Hat AMQ Streams 1.8.0
    fixed: vendor fix RHSA-2021:3225
  • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:3516
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jakarta-el 3.0.3-2.redhat_00006.1.el8eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el8eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el8eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el8eap, +59 more
    fixed: vendor fix RHSA-2021:3468
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jakarta-el 3.0.3-2.redhat_00006.1.el6eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el6eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el6eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el6eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el6eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el6eap, +59 more
    fixed: vendor fix RHSA-2021:3466
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jakarta-el 3.0.3-2.redhat_00006.1.el7eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el7eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el7eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el7eap, +61 more
    fixed: vendor fix RHSA-2021:3467
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io 2.10.0-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2021:3656
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io 2.10.0-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2021:3658
  • Red Hat JBoss Enterprise Application Platform commons-io 2.10.0.redhat-00001
    fixed: vendor fix RHSA-2021:3660
  • Red Hat Single Sign-On 7.4.9
    fixed: vendor fix RHSA-2021:3534
  • Red Hat RHDM 7.12.1
    fixed: vendor fix RHSA-2022:1110
  • Red Hat RHPAM 7.12.1
    fixed: vendor fix RHSA-2022:1108
  • Red Hat Vert.x 4.1.0
    fixed: vendor fix RHSA-2021:2465
  • Red Hat build of Quarkus commons-io Red Hat Enterprise Linux 8 apache-commons-io, apache-commons-io-javadoc Red Hat Enterprise Linux 9 apache-commons-io, apache-commons-io-javadoc Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-yasson 1.0.9-1.redhat_00001.1.el7eap, eap7-velocity 2.3.0-1.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el7eap, eap7-jakarta-el 3.0.3-2.redhat_00006.1.el7eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el7eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el7eap, +52 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-yasson 1.0.9-1.redhat_00001.1.el8eap, eap7-velocity 2.3.0-1.redhat_00001.1.el8eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el8eap, eap7-jakarta-el 3.0.3-2.redhat_00006.1.el8eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el8eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el8eap, +50 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1442 more
    +1 more products
    Red Hat JBoss Operations Network 3 commons-io
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
32 d ago

Exploit prediction

10.55% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • issues.apache.org https://issues.apache.org/jira/browse/IO-556 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven commons-io:commons-io
<2.7
2.7
maven com.cosium.vet:vet
>=1.0, <=3.22
 no fix listed
maven com.diamondq.common:common-thirdparty.jcasbin
1 listed version
 no fix listed
maven com.liferay:com.liferay.sass.compiler.jsass
1 listed version
 no fix listed
maven com.virjar:ratel-api
>=1.0.0, <=1.3.6
 no fix listed
maven net.hasor:cobble-lang
>=4.4.1, <=4.6.2
 no fix listed
maven org.apache.commons:commons-io
1 listed version
 no fix listed
maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io
>=1.4, <=1.5
 no fix listed
maven org.checkerframework.annotatedlib:commons-io
>=2.6, <2.7
2.7
maven org.smartboot.servlet:servlet-core
>=0.1.9, <=0.6
 no fix listed

Affected products

  • Apache Software Foundation Apache Commons IO

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.