CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO
Attackers can access files in the parent directory via limited path traversal in Apache Commons IO when using FileNameUtils.normalize.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29425?
CVE-2021-29425 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Which versions are affected by CVE-2021-29425?
20 open source packages ship an affected version, including com.cosium.vet:vet, com.diamondq.common:common-thirdparty.jcasbin and com.liferay:com.liferay.sass.compiler.jsass. It affects 60 products.
| Package | Affected | Fixed in |
|---|---|---|
com.cosium.vet:vet Maven | From 1.0 to 3.22 | None |
com.cosium.vet:vet Maven | From 1.0 to 3.22 | None |
com.diamondq.common:common-thirdparty.jcasbin Maven | All versions | None |
com.diamondq.common:common-thirdparty.jcasbin Maven | All versions | None |
com.liferay:com.liferay.sass.compiler.jsass Maven | All versions | None |
com.liferay:com.liferay.sass.compiler.jsass Maven | All versions | None |
14 more packages
com.virjar:ratel-api Maven | From 1.0.0 to 1.3.6 | None |
com.virjar:ratel-api Maven | From 1.0.0 to 1.3.6 | None |
commons-io:commons-io Maven | All versions | 2.7 |
commons-io:commons-io Maven | All versions | 2.7 |
net.hasor:cobble-lang Maven | From 4.4.1 to 4.6.2 | None |
net.hasor:cobble-lang Maven | From 4.4.1 to 4.6.2 | None |
org.apache.commons:commons-io Maven | All versions | None |
org.apache.commons:commons-io Maven | All versions | None |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io Maven | From 1.4 to 1.5 | None |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io Maven | From 1.4 to 1.5 | None |
org.checkerframework.annotatedlib:commons-io Maven | From 2.6 | 2.7 |
org.checkerframework.annotatedlib:commons-io Maven | From 2.6 | 2.7 |
org.smartboot.servlet:servlet-core Maven | From 0.1.9 to 0.6 | None |
org.smartboot.servlet:servlet-core Maven | From 0.1.9 to 0.6 | None |
Linux distribution packages (6)
apache-commons-io SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.6-3.3.1 |
apache-commons-io SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.4-9.3.1 |
apache-commons-io SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.4-9.3.1 |
apache-commons-io SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.4-9.3.1 |
apache-commons-io openSUSE:Leap 15.2 | All versions | 2.6-lp152.2.3.1 |
apache-commons-io openSUSE:Tumbleweed | All versions | 2.11.0-2.1 |
Products include Apache Commons Io, Debian Debian Linux, Netapp Active Iq Unified Manager, Oracle Access Manager, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management and 54 more.
How do I fix CVE-2021-29425?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-29425 being exploited?
There is no known exploitation of CVE-2021-29425 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2025-FS45495, CLEANSTART-2026-CT42491, CLSA-2026-1775003206, CLSA-2026-1783386138, CLSA-2026-1786520534, DEBIAN-CVE-2021-29425 and 11 more.