CVE-2025-30474 Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-30474?
CVE-2025-30474 is a medium-severity vulnerability in Apache Commons VFS, published on 23 Mar 2025.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.
The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.
Users are recommended to upgrade to version 2.10.0, which fixes the issue.
Weakness: CWE-200
Which versions are affected by CVE-2025-30474?
2 open source packages ship an affected version, including org.apache.commons:commons-vfs2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-vfs2 Maven | All versions | 2.10.0 |
org.apache.commons:commons-vfs2 Maven | All versions | 2.10.0 |
Products include Apache Commons Vfs.
How do I fix CVE-2025-30474?
Upgrade org.apache.commons:commons-vfs2 to 2.10.0 or later.
Is CVE-2025-30474 being exploited?
There is no known exploitation of CVE-2025-30474 in the wild and no public exploit code.
Other vulnerabilities in Apache Commons VFS
Sources
Also known as DEBIAN-CVE-2025-30474, GHSA-3936-3gx6-49c4, UBUNTU-CVE-2025-30474.