{"id":"CVE-2025-27553","aliases":["CLSA-2026-1778460297","CLSA-2026-1780361380","CLSA-2026-1784164089","DEBIAN-CVE-2025-27553","DLA-4111-1","EUVD-2025-7319","GHSA-9q4x-fr4m-jp86","OESA-2025-1356","OESA-2025-1357","OESA-2025-1940","OESA-2025-1941","OESA-2025-1942","RHSA-2025:10548","SUSE-SU-2025:1022-1","UBUNTU-CVE-2025-27553","openSUSE-SU-2025:14929-1"],"status":"published","title":"Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01425,"percentile":0.73294,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2025-03-23T14:16:20Z","modified":"2026-11-02T19:45:43Z","fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","fixed_in":["2.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-vfs2","fixed_in":["2.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"commons-vfs","fixed_in":["2.1-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-vfs","fixed_in":["2.1-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-vfs","fixed_in":["2.1-5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"commons-vfs","fixed_in":["2.1-2+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-vfs","fixed_in":["2.1-16.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-vfs","fixed_in":["2.1-16.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-vfs","fixed_in":["2.1-16.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs","fixed_in":["0:2.0-11.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-ant","fixed_in":["0:2.0-11.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-examples","fixed_in":["0:2.0-11.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-javadoc","fixed_in":["0:2.0-11.el7_9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.0-tuxcare.1"}]}],"versions":["2.0"]},{"source":"osv","ecosystem":"Debian:12","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-4+deb12u1"}]}],"versions":["2.1-4"]},{"source":"osv","ecosystem":"Debian:13","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-5"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-2+deb11u1"}]}],"versions":["2.1-2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}],"versions":["2.0","2.1","2.2","2.3","2.4","2.4.1","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-16.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-16.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-16.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-11.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-11.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-11.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"apache-commons-vfs-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-11.el7_9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0-3ubuntu1","2.0-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-1","2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-4","2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"commons_vfs"},{"vendor":"apache software foundation","product":"apache commons vfs"}],"references":[{"url":"https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/23/1","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00006.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27553","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9q4x-fr4m-jp86"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27553","tags":["advisory"]},{"url":"https://github.com/apache/commons-vfs","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30474","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1357","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1940","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1941","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1942","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10548","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2354334","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10548.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27553","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239973","tags":["report"]},{"url":"https://bugzilla.suse.com/1239974","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30474","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-27553","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/03/23/1","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJEKF3EWGBGJVNKZDARY564OGCSKZCWT/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-27553","title":"Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T14:16:20.363Z","modified":"2025-04-02T22:03:21.278Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-7319","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T14:16:20Z","modified":"2025-04-02T22:03:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"ghsa":[{"id":"GHSA-9q4x-fr4m-jp86","title":"Apache Commons VFS Has Relative Path Traversal Vulnerability","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:30:33Z","modified":"2025-04-03T00:32:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2025-27553","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:13.377Z","modified":"2026-06-17T09:03:47.477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-27553","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:13.377Z","modified":"2026-03-15T22:20:44.311131Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-27553","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.  The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of the base file\". However, when the path contains encoded \"..\" characters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.  Users are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:13.377Z","modified":"2026-09-01T20:05:45.920574004Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-9q4x-fr4m-jp86","title":"Apache Commons VFS Has Relative Path Traversal Vulnerability","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:30:33Z","modified":"2025-04-03T01:24:03.415749Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"OESA-2025-1356","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:51.101470754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1357","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:50.961675922Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1940","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)","status":"published","published":"2025-08-01T11:09:01Z","modified":"2026-08-18T01:18:56.304273217Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1941","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)","status":"published","published":"2025-08-01T11:09:01Z","modified":"2026-08-18T01:18:56.013873092Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1942","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)","status":"published","published":"2025-08-01T11:09:01Z","modified":"2026-08-18T01:18:57.2032608Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:10548","title":"Red Hat Security Advisory: apache-commons-vfs security update","status":"published","published":"2025-07-08T10:04:18Z","modified":"2026-06-29T11:06:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2025-27553","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of the base file\". However, when the path contains encoded \"..\" characters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:00Z","modified":"2026-10-17T12:56:49.535025456Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1778460297","title":"TuxCare security update for com.microsoft.ews-java-api:ews-java-api (1 CVE)","description":"TuxCare rebuilt com.microsoft.ews-java-api:ews-java-api to address 1 CVE. Fixed in 2.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:30Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1780361380","title":"TuxCare security update for commons-digester:commons-digester (1 CVE)","description":"TuxCare rebuilt commons-digester:commons-digester to address 1 CVE. Fixed in 2.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1784164089","title":"TuxCare security update for org.apache.commons:commons-vfs2 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-vfs2 to address 1 CVE. Fixed in 2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:43.418664388Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"DLA-4111-1","title":"commons-vfs - security update","status":"published","published":"2025-04-02T00:00:00Z","modified":"2026-03-09T01:22:39.055544Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2025:14929-1","title":"apache-commons-vfs2-2.10.0-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-26T00:00:00Z","modified":"2026-02-04T02:55:28.245932Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:1022-1","title":"Security update for apache-commons-vfs2","description":"This update for apache-commons-vfs2 fixes the following issues:\n\n- CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT (bsc#1239973)\n- CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message (bsc#1239974)\n\nOther fixes:\n- Upgrade to upstream version 2.10.0\n","status":"published","published":"2025-03-26T11:28:34Z","modified":"2026-02-04T03:50:27.343658Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}