6.5

CVE-2021-29425: Possible limited path traversal vulnerabily in Apache Commons IO

Modified
AliasesSUSE-SU-2021:1282-1SUSE-SU-2021:1315-1UBUNTU-CVE-2021-29425
Published 13-04-2021Last modified 07-10-2026

Vulnerability summary

CVE-2021-29425 is a medium (CVSS 6.5) Improper Input Validation vulnerability in apache software foundation apache commons io. EPSS estimates a 10.55% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
10.55%
0%100%
Medium · +0.64 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 1
RHSA-2021:3466RHSA-2021:3467RHSA-2021:3468RHSA-2021:3656RHSA-2021:3658CGA-2266-XCQQ-QPF4

Timeline

  1. 13-04-2021
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

10.55%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.64 pp

From 9.90% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (issues.apache.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard106 products
  • druid< 35.0.1-r1 | All versions (No fix recorded)
  • eco-java-gradle-1.11All versions (No fix recorded)
  • eco-java-gradle-2.0All versions (No fix recorded)
  • eco-java-gradle-2.1All versions (No fix recorded)
  • eco-java-gradle-2.10All versions (No fix recorded)
Oracle57 products
Suse4 products
  • apache-commons-io&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.6-3.3.1
  • apache-commons-io&distro=SUSE Linux Enterprise Server 12 SP5< 2.4-9.3.1
  • apache-commons-io&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4-9.3.1
  • apache-commons-io&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.4-9.3.1
Debian2 products
Opensuse2 products
  • apache-commons-io&distro=openSUSE Leap 15.2< 2.6-lp152.2.3.1
  • apache-commons-io&distro=openSUSE Tumbleweed< 2.11.0-2.1
Apache1 product
Apache software foundation1 product
  • apache commons ioApache Commons IO 2.2 | Apache Commons IO 2.3 | Apache Commons IO 2.4 | Apache Commons IO 2.5 | Apache Commons IO 2.6
Com.cosium.vet1 product
  • vet≥ 1.0, ≤ 3.22
Com.diamondq.common1 product
  • common-thirdparty.jcasbin1.4.0
Com.liferay1 product
  • com.liferay.sass.compiler.jsass1.0.1
Com.virjar1 product
  • ratel-api≥ 1.0.0, ≤ 1.3.6
Commons-io1 product
  • commons-io< 2.7
Net.hasor1 product
  • cobble-lang≥ 4.4.1, ≤ 4.6.2
Netapp1 product
Org.apache.commons1 product
  • commons-io1.3.2
Org.apache.servicemix.bundles1 product
  • org.apache.servicemix.bundles.commons-io≥ 1.4, ≤ 1.5
Org.checkerframework.annotatedlib1 product
  • commons-io≥ 2.6, < 2.7
Org.smartboot.servlet1 product
  • servlet-core≥ 0.1.9, ≤ 0.6
Ubuntu1 product
  • commons-io< 2.6-2ubuntu0.18.04.1 | < 2.6-2ubuntu0.20.04.1 | < 2.4-2ubuntu0.1~esm1 | All versions (No fix recorded)
Wolfi1 product
  • druid< 35.0.1-r1 | All versions (No fix recorded)

20 vendors · 186 products

References

100 links
Show all 100 references