MediumFix available
commons-io — security advisory
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
- Products
- commons-io
- Affected versions
- 2.4-2, 2.4-2ubuntu0.16.04.1~esm1, 2.5-1, 2.5-2, 2.6-1, 2.6-2
- Fixed versions
- 2.4-2ubuntu0.1~esm1, 2.6-2ubuntu0.18.04.1, 2.6-2ubuntu0.20.04.1
- CVEs
- CVE-2021-29425
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 10:03 UTC · Revision 1
Source evidence
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
osv:UBUNTU-CVE-2021-29425
commons-io
Fixed versions: 2.4-2ubuntu0.1~esm1
commons-io
Fixed versions: Not specified
commons-io
Fixed versions: 2.6-2ubuntu0.18.04.1
commons-io
Fixed versions: 2.6-2ubuntu0.20.04.1
Complete source record
{
"id": "890128795171362c66298028f01f69dd0ea279370f338917395bf08fea55f83f",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-29425",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2021-29425",
"summary": "In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.",
"evidence": "osv:UBUNTU-CVE-2021-29425",
"products": [
{
"name": {
"value": "commons-io",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4-2ubuntu0.1~esm1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.4-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "commons-io",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.4-2ubuntu0.16.04.1~esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "commons-io",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6-2ubuntu0.18.04.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "2.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "2.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.6-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "commons-io",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.6-2ubuntu0.20.04.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "2.6-2",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2021-29425",
"aliases": [
"UBUNTU-CVE-2021-29425"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4-2ubuntu0.1~esm1"
}
]
}
],
"package": {
"name": "commons-io",
"purl": "pkg:deb/ubuntu/commons-io?arch=source&distro=trusty%2Fesm",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"2.4-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29425.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-io-java",
"binary_version": "2.4-2ubuntu0.1~esm1"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "commons-io",
"purl": "pkg:deb/ubuntu/commons-io?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"2.4-2",
"2.4-2ubuntu0.16.04.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29425.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-io-java",
"binary_version": "2.4-2ubuntu0.16.04.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6-2ubuntu0.18.04.1"
}
]
}
],
"package": {
"name": "commons-io",
"purl": "pkg:deb/ubuntu/commons-io?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.5-1",
"2.5-2",
"2.6-1",
"2.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29425.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-io-java",
"binary_version": "2.6-2ubuntu0.18.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6-2ubuntu0.20.04.1"
}
]
}
],
"package": {
"name": "commons-io",
"purl": "pkg:deb/ubuntu/commons-io?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"2.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29425.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-io-java",
"binary_version": "2.6-2ubuntu0.20.04.1"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-08T19:46:19.969512487Z",
"provider": "osv",
"upstream": [
"CVE-2021-29425"
],
"references": [
"https://ubuntu.com/security/CVE-2021-29425",
"https://www.openwall.com/lists/oss-security/2021/04/12/1",
"https://issues.apache.org/jira/browse/IO-556",
"https://ubuntu.com/security/notices/USN-5095-1",
"https://www.cve.org/CVERecord?id=CVE-2021-29425"
]
},
"related_cves": [
{
"value": "CVE-2021-29425",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 104504,
"published_at": "2021-04-13T07:15:00+00:00"
}