CVE-2016-1000031
Improper Access Control in commons-fileupload
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
CVE-2016-1000031- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2018-0802
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
EUVD-2018-0802- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7x9j-7223-rg5m
Improper Access Control in commons-fileupload
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
GHSA-7x9j-7223-rg5m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
CVE-2016-1000031- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
CVE-2016-1000031- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1000031
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
DEBIAN-CVE-2016-1000031- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-7x9j-7223-rg5m
Improper Access Control in commons-fileupload
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
GHSA-7x9j-7223-rg5m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1000031
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- Record
UBUNTU-CVE-2016-1000031- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776040405 No score
TuxCare security update for commons-fileupload:commons-fileupload (3 CVEs)
TuxCare rebuilt commons-fileupload:commons-fileupload to address 3 CVEs. Fixed in 1.2.2-tuxcare.1.
- Record
CLSA-2026-1776040405- Updated
- 2026-11-02
OSVCLSA-2026-1776040406 No score
TuxCare security update for commons-fileupload:commons-fileupload (3 CVEs)
TuxCare rebuilt commons-fileupload:commons-fileupload to address 3 CVEs. Fixed in 1.2.1-tuxcare.1.
- Record
CLSA-2026-1776040406- Updated
- 2026-11-02
OSVCLSA-2026-1786449156 No score
TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)
TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.2.
- Record
CLSA-2026-1786449156- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1399-1 No score
Security update for jakarta-commons-fileupload
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1399-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1212-1 No score
Security update for jakarta-commons-fileupload
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
- Record
SUSE-SU-2019:1212-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1212-2 No score
Security update for jakarta-commons-fileupload
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
- Record
SUSE-SU-2019:1212-2- Updated
- 2026-11-02
OSVSUSE-SU-2019:1214-1 No score
Security update for jakarta-commons-fileupload
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
- Record
SUSE-SU-2019:1214-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14044-1 No score
Security update for jakarta-commons-fileupload
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
- Record
SUSE-SU-2019:14044-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
commons-fileupload:commons-fileuploadMaven |
before 1.3.3 | 1.3.3 |
commons-fileupload:commons-fileuploadTuxCare:Maven From an advisory covering 3 CVEs |
1.2.2 up to 1.2.2-tuxcare.1 | 1.2.2-tuxcare.1 |
commons-fileupload:commons-fileuploadTuxCare:Maven From an advisory covering 3 CVEs |
1.2.1 up to 1.2.1-tuxcare.1 | 1.2.1-tuxcare.1 |
commons-fileupload:commons-fileuploadTuxCare:Maven From an advisory covering 2 CVEs |
1.3.1 up to 1.3.1-tuxcare.2, plus listed versions 1.3.1-tuxcare.1 |
1.3.1-tuxcare.2 |
libcommons-fileupload-javaDebian:12 |
All versions, plus listed versions 1.4-21.5-11.5-1.1 |
None known |
libcommons-fileupload-javaDebian:13 |
All versions, plus listed versions 1.5-1.1 |
None known |
libcommons-fileupload-javaDebian:14 |
All versions, plus listed versions 1.5-1.1 |
None known |
commons-fileupload:commons-fileuploadMaven |
before 1.3.3, plus listed versions 1.01.0-beta-11.0-rc11.11.1.1 Show 8 moreShow less1.21.2.11.2.21.31.3.11.3.1-jenkins-11.3.1-jenkins-21.3.2 |
1.3.3 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Module for Web and Scripting 15 |
before 1.1.1-4.3.1 | 1.1.1-4.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Module for Web and Scripting 15 SP1 |
before 1.1.1-4.3.1 | 1.1.1-4.3.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jakarta-commons-fileuploadSUSE:OpenStack Cloud 7 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12-LTSS |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12 SP3 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 12 SP4 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Enterprise Storage 4 |
before 1.1.1-122.3.1 | 1.1.1-122.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Point of Sale 11 SP3 |
before 1.1.1-1.37.3.1 | 1.1.1-1.37.3.1 |
jakarta-commons-fileuploadSUSE:Linux Enterprise Server 11 SP4-LTSS |
before 1.1.1-1.37.3.1 | 1.1.1-1.37.3.1 |
tomcat6Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 6.0.37-16.0.39-16.0.39-1ubuntu0.16.0.39-1ubuntu0.1+esm16.0.39-1ubuntu0.1+esm26.0.39-1ubuntu0.1+esm3 |
None known |
tomcat7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1 Show 13 moreShow less7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.117.0.52-1ubuntu0.137.0.52-1ubuntu0.147.0.52-1ubuntu0.157.0.52-1ubuntu0.167.0.52-1ubuntu0.16+esm17.0.52-1ubuntu0.16+esm2 |
None known |
tomcat8Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1 Show 14 moreShow less8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2 |
None known |
libcommons-fileupload-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.1-11.3.1-21.3.1-2ubuntu0.1 |
None known |
tomcat6Ubuntu:16.04:LTS |
All versions, plus listed versions 6.0.41-46.0.45+dfsg-16.0.45+dfsg-1ubuntu0.16.0.45+dfsg-1ubuntu0.2 |
None known |
tomcat7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.0.64-17.0.68-17.0.68-1ubuntu0.17.0.68-1ubuntu0.37.0.68-1ubuntu0.4 Show 4 moreShow less7.0.68-1ubuntu0.4+esm17.0.68-1ubuntu0.4+esm27.0.68-1ubuntu0.4+esm37.0.68-1ubuntu0.4+esm4 |
None known |
jakarta-commons-fileuploadopenSUSE:Leap 15.0 |
before 1.1.1-lp150.2.3.1 | 1.1.1-lp150.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000031 is a critical vulnerability (CVSS 9.8) in Apache Commons Fileupload, published October 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.7%, the 98th percentile. Fixed in commons-fileupload:commons-fileupload 1.3.3.
References
securityfocus.com/bid/93604
lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E
lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html
oracle.com/security-alerts/cpuapr2020.html
Show 33 moreShow less
security.netapp.com/advisory/ntap-20190212-0001
issues.apache.org/jira/browse/WW-4812
zerodayinitiative.com/advisories/ZDI-16-570
tenable.com/security/research/tra-2016-30
nvd.nist.gov/vuln/detail/CVE-2016-1000031
github.com/advisories/GHSA-7x9j-7223-rg5m
security-tracker.debian.org/tracker/CVE-2016-1000031
suse.com/support/update/announcement/2019/suse-su-20191212-1
bugzilla.suse.com/1128829
ubuntu.com/security/CVE-2016-1000031
cve.org/CVERecord?id=CVE-2016-1000031