CVE-2016-1000031 Improper Access Control in commons-fileupload
Attackers can achieve remote code execution by exploiting unsafe deserialization in the Apache Commons FileUpload library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1000031?
CVE-2016-1000031 is a critical unsafe deserialization vulnerability in n/a, published on 25 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Weakness: CWE-284
Which versions are affected by CVE-2016-1000031?
2 open source packages ship an affected version, including commons-fileupload:commons-fileupload. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
commons-fileupload:commons-fileupload Maven | All versions | 1.3.3 |
commons-fileupload:commons-fileupload Maven | All versions | 1.3.3 |
Linux distribution packages (17)
jakarta-commons-fileupload SUSE:Enterprise Storage 4 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Module for Web and Scripting 15 | All versions | 1.1.1-4.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | All versions | 1.1.1-4.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 1.1.1-1.37.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 1.1.1-1.37.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server 12-LTSS | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload SUSE:OpenStack Cloud 7 | All versions | 1.1.1-122.3.1 |
jakarta-commons-fileupload openSUSE:Leap 15.0 | All versions | 1.1.1-lp150.2.3.1 |
Products include Apache Commons Fileupload.
How do I fix CVE-2016-1000031?
Upgrade commons-fileupload:commons-fileupload to 1.3.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-1000031 being exploited?
There is no known exploitation of CVE-2016-1000031 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
- CVE-2023-24998 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
- CVE-2016-3092 High severity vulnerability that affects commons-fileupload:commons-fileupload
- CVE-2014-0050 Commons FileUpload Denial of service vulnerability
- CVE-2013-0248 Incorrect Default Permissions in Apache Commons FileUpload
Sources
Also known as DEBIAN-CVE-2016-1000031, GHSA-7x9j-7223-rg5m, SUSE-SU-2019:1212-1, SUSE-SU-2019:1212-2, SUSE-SU-2019:1214-1, SUSE-SU-2019:14044-1 and 2 more.