CVE-2025-27553

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-275549.9ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commanCVE-2025-275556.5Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit lCVE-2025-275567.5An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, djangCVE-2025-275589.1IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or CVE-2025-275596.7Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enaCVE-2025-27568.8A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporCVE-2025-275606.0Loop with unreachable exit condition ('infinite loop') for some Intel(R) Platform within Ring 0: Kernel may allow a denial of service. SysteCVE-2025-275615.3Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-275625.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-275635.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.CVE-2025-275655.3An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-275667.2Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with ins