GHSA-gwrp-pvrq-jmwv · Severity: medium · Ecosystem: maven — Path Traversal and Improper Input Validation in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Conclusion & alert: CVE-2021-29425 is rated High Exploit Risk (72.5/100): CVSS Medium severity, with high exploitation likelihood (EPSS 10.61%, 95th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +10.00% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.61% | 10.61% | +10.00% |
| 2 | 2026-06-10 | 0.48% | 0.61% | +0.12% |
| 3 | 2026-03-08 | — | 0.48% | — |
Full EPSS history (70 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.8 | 3.1 | MEDIUM |
|
2.2 | 2.5 | [email protected] |
| 5.8 | 2.0 | MEDIUM |
|
8.6 | 4.9 | [email protected] |
GHSA-gwrp-pvrq-jmwv · Severity: medium · Ecosystem: maven — Path Traversal and Improper Input Validation in Apache Commons IO
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-29425 not yet assigned priority: Debian including 1 source packages (commons-io), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-29425 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-29425 |
suse
|
medium | CVE-2021-29425 severity moderate: SUSE including 248 source package names (11-6.2:apache-commons-io-2.6-3.3.1, 17.0.15.0-7.6:apache-commons-io-2.6-3.3.1, …), 286 product×package rows across 50 product lines (Container bci/openjdk-devel, Container containers/apache-pulsar, … (50 product lines)): Known Affected 231, Fixed 55. | https://www.suse.com/security/cve/CVE-2021-29425/ |
ubuntu
|
medium | CVE-2021-29425 medium priority: Ubuntu including 1 source packages (commons-io), 16 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 10, released 4, ignored 1, needed 1. | https://ubuntu.com/security/CVE-2021-29425 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | commons_io | 2.2 | cpe:2.3:a:apache:commons_io:2.2:-:*:*:*:*:*:* |
| apache | commons_io | 2.3 | cpe:2.3:a:apache:commons_io:2.3:-:*:*:*:*:*:* |
| apache | commons_io | 2.4 | cpe:2.3:a:apache:commons_io:2.4:-:*:*:*:*:*:* |
| apache | commons_io | 2.5 | cpe:2.3:a:apache:commons_io:2.5:-:*:*:*:*:*:* |
| apache | commons_io | 2.6 | cpe:2.3:a:apache:commons_io:2.6:-:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| oracle | access_manager | 11.1.2.3.0 | cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:* |
| oracle | access_manager | 12.2.1.3.0 | cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | access_manager | 12.2.1.4.0 | cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | agile_engineering_data_management | 6.2.1.0 | cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* |
| oracle | agile_plm | 9.3.6 | cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* |
| oracle | application_performance_management | 13.4.1.0 | cpe:2.3:a:oracle:application_performance_management:13.4.1.0:*:*:*:*:*:*:* |
| oracle | application_performance_management | 13.5.1.0 | cpe:2.3:a:oracle:application_performance_management:13.5.1.0:*:*:*:*:*:*:* |
| oracle | application_testing_suite | 13.3.0.1 | cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* |
| oracle | banking_apis | 18.1 | cpe:2.3:a:oracle:banking_apis:18.1:*:*:*:*:*:*:* |
| oracle | banking_apis | 18.2 | cpe:2.3:a:oracle:banking_apis:18.2:*:*:*:*:*:*:* |
| oracle | banking_apis | 18.3 | cpe:2.3:a:oracle:banking_apis:18.3:*:*:*:*:*:*:* |
| oracle | banking_apis | 19.1 | cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* |
| oracle | banking_apis | 19.2 | cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* |
| oracle | banking_apis | 20.1 | cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* |
| oracle | banking_apis | 21.1 | cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 17.2 | cpe:2.3:a:oracle:banking_digital_experience:17.2:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 18.1 | cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 18.3 | cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 19.1 | cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 19.2 | cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 20.1 | cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* |
| oracle | banking_digital_experience | 21.1 | cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.6.2 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.7.0 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.7.1 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.10.0 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.12.0 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_managment | >= 2.3.0, <= 2.4.0 | cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:* |
| oracle | banking_party_management | 2.7.0 | cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* |
| oracle | banking_platform | >= 2.3.0, <= 2.4.1 | cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.6.2 | cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.7.0 | cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.7.1 | cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* |
| oracle | blockchain_platform | < 21.1.2 | cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* |
| oracle | commerce_guided_search | 11.3.2 | cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* |
| oracle | communications_application_session_controller | 3.9.0 | cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:* |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 11.3 | cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:* |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 12.0 | cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_network_repository_function | 1.14.0 | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_policy | 1.14.0 | cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_unified_data_repository | 1.4.0 | cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:* |
| oracle | communications_contacts_server | 8.0.0.6.0 | cpe:2.3:a:oracle:communications_contacts_server:8.0.0.6.0:*:*:*:*:*:*:* |
| oracle | communications_converged_application_server_-_service_controller | 6.2 | cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:* |
| oracle | communications_convergence | 3.0.2.2.0 | cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:* |
| oracle | communications_design_studio | >= 7.4.0, <= 7.4.2 | cpe:2.3:a:oracle:communications_design_studio:*:*:*:*:*:*:*:* |
| oracle | communications_design_studio | 7.3.5 | cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:* |
| oracle | communications_diameter_intelligence_hub | >= 8.0.0, <= 8.1.0 | cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* |
| oracle | communications_diameter_intelligence_hub | >= 8.2.0, <= 8.2.3 | cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* |
| oracle | communications_interactive_session_recorder | 6.3 | cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* |
| oracle | communications_interactive_session_recorder | 6.4 | cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* |
| oracle | communications_offline_mediation_controller | 12.0.0.3 | cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:* |
| oracle | communications_order_and_service_management | 7.3 | cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* |
| oracle | communications_order_and_service_management | 7.4 | cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* |
| oracle | communications_policy_management | 12.5.0.0.0 | cpe:2.3:a:oracle:communications_policy_management:12.5.0.0.0:*:*:*:*:*:*:* |
| oracle | communications_pricing_design_center | 12.0.0.4.0 | cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* |
| oracle | communications_pricing_design_center | 12.0.0.5.0 | cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:* |
| oracle | communications_service_broker | 6.2 | cpe:2.3:a:oracle:communications_service_broker:6.2:*:*:*:*:*:*:* |
| oracle | enterprise_communications_broker | 3.3 | cpe:2.3:a:oracle:enterprise_communications_broker:3.3:*:*:*:*:*:*:* |
| oracle | enterprise_session_border_controller | 8.4 | cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* |
| oracle | enterprise_session_border_controller | 9.0 | cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:* |
| oracle | financial_services_analytical_applications_infrastructure | >= 8.0.7, <= 8.1.1 | cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* |
| oracle | financial_services_model_management_and_governance | >= 8.0.8, <= 8.1.1 | cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:* |
| oracle | flexcube_core_banking | >= 11.6.0, <= 11.8.0 | cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:* |
| oracle | flexcube_core_banking | 5.2.0 | cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:* |
| oracle | flexcube_core_banking | 11.10.0 | cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:* |
| oracle | fusion_middleware_mapviewer | 12.2.1.4.0 | cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | health_sciences_data_management_workbench | 2.5.2.1 | cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* |
| oracle | health_sciences_data_management_workbench | 3.0.0.0 | cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* |
| oracle | health_sciences_information_manager | >= 3.0.1, <= 3.0.4 | cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:* |
| oracle | healthcare_data_repository | 8.1.0 | cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* |
| oracle | helidon | 1.4.7 | cpe:2.3:a:oracle:helidon:1.4.7:*:*:*:*:*:*:* |
| oracle | helidon | 2.2.0 | cpe:2.3:a:oracle:helidon:2.2.0:*:*:*:*:*:*:* |
| oracle | insurance_policy_administration | 11.0.2 | cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* |
| oracle | insurance_policy_administration | 11.1.0 | cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* |