https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:01:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-02220 bdu:2021-02220 https://cve.radiocsirt.org/vuln/bdu:2021-02220 https://cve.radiocsirt.org/vuln/certfr-2021-avi-474 certfr-2021-avi-474 https://cve.radiocsirt.org/vuln/certfr-2021-avi-474 https://cve.radiocsirt.org/vuln/cnvd-2021-30583 cnvd-2021-30583 https://cve.radiocsirt.org/vuln/cnvd-2021-30583 https://cve.radiocsirt.org/vuln/euvd-2026-26327 EUVD-2026-26327 https://cve.radiocsirt.org/vuln/euvd-2026-26327 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29425 <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29425 https://cve.radiocsirt.org/vuln/ghsa-gwrp-pvrq-jmwv <p><strong>Affected:</strong> Maven: commons-io:commons-io, Maven: com.cosium.vet:vet, Maven: com.diamondq.common:common-thirdparty.jcasbin, Maven: com.liferay:com.liferay.sass.compiler.jsass, Maven: com.virjar:ratel-api, Maven: net.hasor:cobble-lang, Maven: org.apache.commons:commons-io, Maven: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io, Maven: org.checkerframework.annotatedlib:commons-io, Maven: org.smartboot.servlet:servlet-core</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> <p><strong>Affected:</strong> Maven: commons-io:commons-io, Maven: com.cosium.vet:vet, Maven: com.diamondq.common:common-thirdparty.jcasbin, Maven: com.liferay:com.liferay.sass.compiler.jsass, Maven: com.virjar:ratel-api, Maven: net.hasor:cobble-lang, Maven: org.apache.commons:commons-io, Maven: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io, Maven: org.checkerframework.annotatedlib:commons-io, Maven: org.smartboot.servlet:servlet-core</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> https://cve.radiocsirt.org/vuln/ghsa-gwrp-pvrq-jmwv https://cve.radiocsirt.org/vuln/gsd-2021-29425 gsd-2021-29425 https://cve.radiocsirt.org/vuln/gsd-2021-29425 https://cve.radiocsirt.org/vuln/oesa-2021-1182 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: apache-commons-io</p> <p>Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.</p> <p>Security Fix(es):</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: apache-commons-io</p> <p>Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.</p> <p>Security Fix(es):</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425)</p> https://cve.radiocsirt.org/vuln/oesa-2021-1182 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0605-1 <p>Security update for apache-commons-io</p> <p>Security update for apache-commons-io</p> https://cve.radiocsirt.org/vuln/opensuse-su-2021:0605-1 https://cve.radiocsirt.org/vuln/rhsa-2021:2465 <p>netty: Request smuggling via content-length header apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6</p> <p>netty: Request smuggling via content-length header apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6</p> https://cve.radiocsirt.org/vuln/rhsa-2021:2465 https://cve.radiocsirt.org/vuln/suse-su-2021:1282-1 <p>Security update for apache-commons-io</p> <p>Security update for apache-commons-io</p> https://cve.radiocsirt.org/vuln/suse-su-2021:1282-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29425 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: commons-io, Ubuntu:Pro:16.04:LTS: commons-io, Ubuntu:18.04:LTS: commons-io, Ubuntu:20.04:LTS: commons-io</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: commons-io, Ubuntu:Pro:16.04:LTS: commons-io, Ubuntu:18.04:LTS: commons-io, Ubuntu:20.04:LTS: commons-io</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29425 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0119 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0119