CVE-2013-0248 Incorrect Default Permissions in Apache Commons FileUpload

What is CVE-2013-0248?

CVE-2013-0248 is a medium-severity path traversal vulnerability in n/a, published on 15 Mar 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Weakness: CWE-264, CWE-59

Which versions are affected by CVE-2013-0248?

2 open source packages ship an affected version, including commons-fileupload:commons-fileupload. It affects 1 product.

Products include Apache Commons Fileupload.

How do I fix CVE-2013-0248?

Upgrade commons-fileupload:commons-fileupload to 1.2.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-0248 being exploited?

There is no known exploitation of CVE-2013-0248 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-1000031 Improper Access Control in commons-fileupload Critical 9.8
• CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers High 7.5
• CVE-2023-24998 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts High 7.5
• CVE-2016-3092 High severity vulnerability that affects commons-fileupload:commons-fileupload High 7.5
• CVE-2014-0050 Commons FileUpload Denial of service vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-0248, GHSA-vm69-474v-7q2w.