CVE-2021-29425
MediumCVSS 4.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Apache Commons IO before version 2.7 has a limited path traversal vulnerability in the FileNameUtils.normalize method. When invoked with an improper input string like "//../foo" or "\\..\foo", the result is the same value, potentially providing access to files in the parent directory, but not further above.
Risk Assessment
The risk is the possibility of accessing files in the parent directory, which could lead to disclosure of sensitive data if the application uses the result to construct paths.
Recommendation
Update Apache Commons IO to version 2.7 or later. Also, avoid passing improper path strings to the normalize method.
Original NVD description (English source)
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.