{"id":"CVE-2025-30474","aliases":["DEBIAN-CVE-2025-30474","EUVD-2025-7320","GHSA-3936-3gx6-49c4","OESA-2025-1356","OESA-2025-1357","SUSE-SU-2025:1022-1","UBUNTU-CVE-2025-30474","openSUSE-SU-2025:14929-1"],"status":"published","title":"Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00887,"percentile":0.59556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-03-23T14:15:51Z","modified":"2026-10-17T12:56:50Z","fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","fixed_in":["2.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"commons-vfs","fixed_in":["2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-vfs","fixed_in":["2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-vfs","fixed_in":["2.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}],"versions":["2.0","2.1","2.2","2.3","2.4","2.4.1","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"apache-commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0-3ubuntu1","2.0-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-1","2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-4","2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"commons-vfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-vfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"commons_vfs"},{"vendor":"apache software foundation","product":"apache commons vfs"}],"references":[{"url":"https://issues.apache.org/jira/browse/VFS-169","tags":["related","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/23/2","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30474","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3936-3gx6-49c4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30474","tags":["advisory"]},{"url":"https://github.com/apache/commons-vfs","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27553","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1357","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239973","tags":["report"]},{"url":"https://bugzilla.suse.com/1239974","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30474","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-30474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30474","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/03/23/2","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJEKF3EWGBGJVNKZDARY564OGCSKZCWT/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-30474","title":"Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T14:15:51.339Z","modified":"2025-04-01T18:04:55.401Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-7320","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T14:15:51Z","modified":"2025-04-01T18:04:55Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:45.339497Z"}],"ghsa":[{"id":"GHSA-3936-3gx6-49c4","title":"Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:30:33Z","modified":"2025-03-25T03:23:12Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2025-30474","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:14.103Z","modified":"2026-06-17T09:08:49.147Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-30474","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:14.103Z","modified":"2026-03-14T12:42:57.169796Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30474","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.  The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.  Users are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:14.103Z","modified":"2026-09-01T20:05:45.835195635Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-3936-3gx6-49c4","title":"Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:30:33Z","modified":"2025-03-25T03:50:54.932958Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"OESA-2025-1356","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:51.101470754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1357","title":"apache-commons-vfs security update","description":"Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: * The API is consistent among various file types. * Support for a wide range of file systems. * Support caching local file system with different fs types. * Event delivery. * Provides in-JVM info caching. * A set of Ant tasks which VFS is enabled. * Easy to be intergrated into applications such as VFS-aware ClassLoader and URLStreamHandlerFactory.\r\n\r\nSecurity Fix(es):\n\nRelative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a \u0026apos;resolveFile\u0026apos; method that\ntakes a \u0026apos;scope\u0026apos; parameter. Specifying \u0026apos;NameScope.DESCENDENT\u0026apos; promises that \u0026quot;an exception is thrown if the resolved file is not a descendent of\nthe base file\u0026quot;. However, when the path contains encoded \u0026quot;..\u0026quot;\ncharacters (for example, \u0026quot;%2E%2E/bar.txt\u0026quot;), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-27553)\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.\n\nThe FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.(CVE-2025-30474)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:50.961675922Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-30474","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.","status":"published","published":"2025-03-23T15:15:00Z","modified":"2026-10-17T12:56:50.083664253Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"openSUSE-SU-2025:14929-1","title":"apache-commons-vfs2-2.10.0-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-26T00:00:00Z","modified":"2026-02-04T02:55:28.245932Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:1022-1","title":"Security update for apache-commons-vfs2","description":"This update for apache-commons-vfs2 fixes the following issues:\n\n- CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT (bsc#1239973)\n- CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message (bsc#1239974)\n\nOther fixes:\n- Upgrade to upstream version 2.10.0\n","status":"published","published":"2025-03-26T11:28:34Z","modified":"2026-02-04T03:50:27.343658Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}