Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 12 Apr 2021 20:25:55 +0200
From: Jochen Wiedmann <>
Subject: CVE-2021-29425 (Possible limited path traversal in Apache Commons IO
 2.2 to 2.6)


I'd like to inform you about a possible limited path traversal
vulnerability, that has been detected in Apache Commons IO 2.2 to 2.6.
This is now being tracked as CVE-2021-29425. Fortunately, this has
already been covered in versions 2.7, and 2.8.

On behalf of the Apache Commons team,

Jochen Wiedmann


In Apache Commons IO before 2.7, When invoking the method
FileNameUtils.normalize with an improper input string, like
"//../foo", or "\\..\foo", the result would be the same value, thus
possibly providing access to files in the parent directory, but not
further above (thus "limited" path traversal), if the calling code
would use the result to construct a path value.

This issue is being tracked as IO-556,IO-559


Neither the method in question (FileNameUtils.normalize) nor any
methods, that invoke it, do actually access any files. There's only a
string returned, from which a path can be constructed. In other words,
a possible workaround would be not passing any unsafe input to

Upgrade to Apache Commons IO 2.7, or later, where the same method
returns the value null, as an indication of "invalid input".



Look, that's why there's rules, understand? So that you think before
you break 'em.

    -- (Terry Pratchett, Thief of Time)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.