Every CVE Search/ Get API key

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

7.5 HighFix available

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.43%Up 1.4 points since Mar 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
CVE-2025-27553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-23
Updated
2026-11-02
EUVDEUVD-2025-7319 7.5

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
EUVD-2025-7319
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9q4x-fr4m-jp86 7.5

Apache Commons VFS Has Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
GHSA-9q4x-fr4m-jp86
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-23
Updated
2026-11-02
NVD 7.5

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
CVE-2025-27553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-23
Updated
2026-11-02
OSV 7.5

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
CVE-2025-27553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-27553 7.5

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
DEBIAN-CVE-2025-27553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 13 moreShow less
OSVGHSA-9q4x-fr4m-jp86 7.5

Apache Commons VFS Has Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
GHSA-9q4x-fr4m-jp86
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-23
Updated
2026-11-02
OSVOESA-2025-1356 7.5

apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.

Security Fix(es):

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.

The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)

Record
OESA-2025-1356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-1357 7.5

apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.

Security Fix(es):

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.

The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)

Record
OESA-2025-1357
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-1940 7.5

apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.

Security Fix(es):

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)

Record
OESA-2025-1940
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-1941 7.5

apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.

Security Fix(es):

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)

Record
OESA-2025-1941
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-1942 7.5

apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.

Security Fix(es):

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)

Record
OESA-2025-1942
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2025:10548 5.3

Red Hat Security Advisory: apache-commons-vfs security update

Record
RHSA-2025:10548
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-27553 7.5

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Record
UBUNTU-CVE-2025-27553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1778460297 No score

TuxCare security update for com.microsoft.ews-java-api:ews-java-api (1 CVE)

TuxCare rebuilt com.microsoft.ews-java-api:ews-java-api to address 1 CVE. Fixed in 2.0-tuxcare.1.

Record
CLSA-2026-1778460297
Updated
2026-11-02
OSVCLSA-2026-1780361380 No score

TuxCare security update for commons-digester:commons-digester (1 CVE)

TuxCare rebuilt commons-digester:commons-digester to address 1 CVE. Fixed in 2.0-tuxcare.1.

Record
CLSA-2026-1780361380
Updated
2026-11-02
OSVCLSA-2026-1784164089 No score

TuxCare security update for org.apache.commons:commons-vfs2 (1 CVE)

TuxCare rebuilt org.apache.commons:commons-vfs2 to address 1 CVE. Fixed in 2.0-tuxcare.1.

Record
CLSA-2026-1784164089
Updated
2026-11-02
OSVopenSUSE-SU-2025:14929-1 No score

apache-commons-vfs2-2.10.0-1.1 on GA media

These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14929-1
Updated
2026-11-02
OSVSUSE-SU-2025:1022-1 No score

Security update for apache-commons-vfs2

This update for apache-commons-vfs2 fixes the following issues:

  • CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT (bsc#1239973)
  • CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message (bsc#1239974)

Other fixes:

  • Upgrade to upstream version 2.10.0
Record
SUSE-SU-2025:1022-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.commons:commons-vfs2
Maven
 before 2.10.0
2.10.0
org.apache.commons:commons-vfs2
TuxCare:Maven
 2.0 up to 2.0-tuxcare.1
2.0-tuxcare.1
commons-vfs
Debian:12
 before 2.1-4+deb12u1, plus listed versions
2.1-4
2.1-4+deb12u1
commons-vfs
Debian:13
 before 2.1-5
2.1-5
commons-vfs
Debian:14
 before 2.1-5
2.1-5
commons-vfs
Debian:11
 before 2.1-2+deb11u1, plus listed versions
2.1-2
2.1-2+deb11u1
org.apache.commons:commons-vfs2
Maven
 before 2.10.0, plus listed versions
2.02.12.22.32.4
Show 6 moreShow less
2.4.12.5.02.6.02.7.02.8.02.9.0
2.10.0
apache-commons-vfs
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.10.0-1.oe2403sp1
2.10.0-1.oe2403sp1
apache-commons-vfs
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 2.10.0-1.oe2403
2.10.0-1.oe2403
apache-commons-vfs
openEuler:22.03-LTS-SP4
 before 2.1-16.oe2203sp4
2.1-16.oe2203sp4
Show 16 moreShow less
Affected packages
PackageAffectedFixed
apache-commons-vfs
openEuler:20.03-LTS-SP4
 before 2.1-16.oe2003sp4
2.1-16.oe2003sp4
apache-commons-vfs
openEuler:22.03-LTS-SP3
 before 2.1-16.oe2203sp3
2.1-16.oe2203sp3
apache-commons-vfs
Red Hat:rhel_els:7
 before 0:2.0-11.el7_9.1
0:2.0-11.el7_9.1
apache-commons-vfs-ant
Red Hat:rhel_els:7
 before 0:2.0-11.el7_9.1
0:2.0-11.el7_9.1
apache-commons-vfs-examples
Red Hat:rhel_els:7
 before 0:2.0-11.el7_9.1
0:2.0-11.el7_9.1
apache-commons-vfs-javadoc
Red Hat:rhel_els:7
 before 0:2.0-11.el7_9.1
0:2.0-11.el7_9.1
apache-commons-vfs2
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 2.10.0-150200.3.3.1
2.10.0-150200.3.3.1
commons-vfs
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0-3ubuntu12.0-7ubuntu1
 None known
commons-vfs
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1-12.1-2
 None known
commons-vfs
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1-2
 None known
commons-vfs
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.1-2
 None known
commons-vfs
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.1-4
 None known
commons-vfs
Ubuntu:25.10
 All versions, plus listed versions
2.1-42.1-5
 None known
commons-vfs
Ubuntu:26.10
 All versions, plus listed versions
2.1-5
 None known
commons-vfs
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.1-5
 None known
apache-commons-vfs2
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.10.0-1.1
2.10.0-1.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27553 is a high vulnerability (CVSS 7.5) in Apache Commons Vfs, published March 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in org.apache.commons:commons-vfs2 2.10.0.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open