CVE-2021-29425

MediumCVSS 4.8/10Last modified Oct 7, 2026

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 13, 2021
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poison CVE-2021-294287.8In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple CVE-2021-294295.5In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access informat CVE-2021-294307.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou CVE-2021-294316.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter CVE-2021-294325.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address CVE-2021-294334.3Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoin CVE-2021-294344.8Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin i CVE-2021-294356.5trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an CVE-2021-294368.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cros CVE-2021-294376.8ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be rea CVE-2021-294385.4The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your app