CVE-2013-2186
No CVSS score yet. EPSS 13% chance of exploitation in the next 30 days. Fixed in commons-fileupload:commons-fileupload 1.3.1.
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:jboss_enterprise_brms_platform
- redhat:jboss_enterprise_portal_platform
- redhat:jboss_enterprise_web_server
- redhat:openshift
- ubuntu:ubuntu
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qx6h-9567-5fqw | Maven | commons-fileupload:commons-fileupload | <1.3.1 | 1.3.1 |