CVE-2025-27553 Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT
Attackers can bypass path restrictions in Apache Commons VFS using encoded traversal sequences, potentially accessing or modifying files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27553?
CVE-2025-27553 is a high-severity path traversal vulnerability in Apache Commons VFS, published on 23 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.
The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
Weakness: CWE-23
Which versions are affected by CVE-2025-27553?
2 open source packages ship an affected version, including org.apache.commons:commons-vfs2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-vfs2 Maven | All versions | 2.10.0 |
org.apache.commons:commons-vfs2 Maven | All versions | 2.10.0 |
Linux distribution packages (4)
apache-commons-vfs Red Hat:rhel_els:7 | All versions | 0:2.0-11.el7_9.1 |
apache-commons-vfs-ant Red Hat:rhel_els:7 | All versions | 0:2.0-11.el7_9.1 |
apache-commons-vfs-examples Red Hat:rhel_els:7 | All versions | 0:2.0-11.el7_9.1 |
apache-commons-vfs-javadoc Red Hat:rhel_els:7 | All versions | 0:2.0-11.el7_9.1 |
Products include Apache Commons Vfs.
How do I fix CVE-2025-27553?
Upgrade org.apache.commons:commons-vfs2 to 2.10.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-27553 being exploited?
There is no known exploitation of CVE-2025-27553 in the wild and no public exploit code.
Other vulnerabilities in Apache Commons VFS
Sources
Also known as CLSA-2026-1784164089, DEBIAN-CVE-2025-27553, DLA-4111-1, GHSA-9q4x-fr4m-jp86, OESA-2025-1940, OESA-2025-1941 and 3 more.