Apache Commons Fileupload vulnerabilities
6 vulnerabilities
Known vulnerabilities in Apache Commons Fileupload, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2025-48976apache software foundation · apache commons fileupload +51 moreApache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.CVSS7.5HighEPSS32.88%PrioritiseCVE-2023-24998apache software foundation · apache commons fileupload +40 moreApache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsApache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.CVSS7.5HighEPSS48.79%PrioritiseCVE-2016-1000031apache · commons_fileupload +23 moreapache commons_fileuploadApache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code ExecutionCVSS9.8CriticalEPSS32.74%PrioritiseCVE-2016-3092apache · commons_fileupload +86 moreapache commons_fileuploadThe MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.CVSS7.8HighEPSS37.17%PrioritiseCVE-2014-0050apache · commons_fileupload +12 moreapache commons_fileuploadMultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.CVSS7.5HighEPSS83.33%RoutineCVE-2013-0248apache · commons_fileupload +2 moreapache commons_fileuploadThe default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.CVSS6.8MediumEPSS0.79%