CVE-2021-29425
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Apache Commons IO
- Vendor
- Apache Software Foundation
- Product
- Apache Commons IO
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| Apache Commons IO 2.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| Apache Commons IO 2.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| Apache Commons IO 2.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| Apache Commons IO 2.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| Apache Commons IO 2.6 | affected | Unavailable | Unavailable | Unavailable | None listed |