CVE-2025-30474
Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
CVE-2025-30474- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2025-7320
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
EUVD-2025-7320- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3936-3gx6-49c4
Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
GHSA-3936-3gx6-49c4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
CVE-2025-30474- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
CVE-2025-30474- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-30474
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
DEBIAN-CVE-2025-30474- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-3936-3gx6-49c4
Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
GHSA-3936-3gx6-49c4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVOESA-2025-1356
apache-commons-vfs security update
Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.
Security Fix(es):
Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.
The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)
- Record
OESA-2025-1356- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1357
apache-commons-vfs security update
Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.
Security Fix(es):
Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.
The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)
- Record
OESA-2025-1357- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-30474
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.
- Record
UBUNTU-CVE-2025-30474- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14929-1 No score
apache-commons-vfs2-2.10.0-1.1 on GA media
These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14929-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1022-1 No score
Security update for apache-commons-vfs2
This update for apache-commons-vfs2 fixes the following issues:
- CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT (bsc#1239973)
- CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message (bsc#1239974)
Other fixes:
- Upgrade to upstream version 2.10.0
- Record
SUSE-SU-2025:1022-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-vfs2Maven |
before 2.10.0 | 2.10.0 |
commons-vfsDebian:12 |
before 2.0-1 | 2.0-1 |
commons-vfsDebian:13 |
before 2.0-1 | 2.0-1 |
commons-vfsDebian:14 |
before 2.0-1 | 2.0-1 |
org.apache.commons:commons-vfs2Maven |
before 2.10.0, plus listed versions 2.02.12.22.32.4 Show 6 moreShow less2.4.12.5.02.6.02.7.02.8.02.9.0 |
2.10.0 |
apache-commons-vfsopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.10.0-1.oe2403sp1 | 2.10.0-1.oe2403sp1 |
apache-commons-vfsopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 2.10.0-1.oe2403 | 2.10.0-1.oe2403 |
apache-commons-vfs2openSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 2.10.0-150200.3.3.1 | 2.10.0-150200.3.3.1 |
commons-vfsUbuntu:16.04:LTS |
All versions, plus listed versions 2.0-3ubuntu12.0-7ubuntu1 |
None known |
commons-vfsUbuntu:18.04:LTS |
All versions, plus listed versions 2.1-12.1-2 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
commons-vfsUbuntu:20.04:LTS |
All versions, plus listed versions 2.1-2 |
None known |
commons-vfsUbuntu:22.04:LTS |
All versions, plus listed versions 2.1-2 |
None known |
commons-vfsUbuntu:24.04:LTS |
All versions, plus listed versions 2.1-4 |
None known |
commons-vfsUbuntu:25.10 |
All versions, plus listed versions 2.1-42.1-5 |
None known |
commons-vfsUbuntu:26.10 |
All versions, plus listed versions 2.1-5 |
None known |
commons-vfsUbuntu:26.04:LTS |
All versions, plus listed versions 2.1-5 |
None known |
apache-commons-vfs2openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.10.0-1.1 | 2.10.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30474 is a medium vulnerability (CVSS 5.0) in Apache Commons Vfs, published March 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in org.apache.commons:commons-vfs2 2.10.0.
References
issues.apache.org/jira/browse/VFS-169
lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4
openwall.com/lists/oss-security/2025/03/23/2
nvd.nist.gov/vuln/detail/CVE-2025-30474
github.com/advisories/GHSA-3936-3gx6-49c4
security-tracker.debian.org/tracker/CVE-2025-30474
Show 12 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1356
suse.com/support/update/announcement/2025/suse-su-20251022-1
bugzilla.suse.com/1239973
ubuntu.com/security/CVE-2025-30474
cve.org/CVERecord?id=CVE-2025-30474
lists.opensuse.org/archives/list/[email protected]/thread/TJEKF3EWGBGJVNKZDARY564OGCSKZCWT