commons-io vulnerabilities

Products

• commons-io/commons-io 2

Latest commons-io CVEs

Newest publication first

1. CVE-2024-47554 Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

   Published 2024-10-03

   Medium·CVSS 4.3 EPSS 1.3%

   Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are rec...

2. CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO

   Published 2021-04-13

   Medium·CVSS 4.8 EPSS 10.5% PoC

   In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limite...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.