CVE-2021-29425

4.8 mediumEPSS 11%

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CVSS 3.1: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
CWEs: CWE-22, CWE-20
Published: 2021-04-13
Modified: 2026-10-07
Record from: the NVD, synced 2026-10-19

Affected

apache:commons_io
debian:debian_linux
netapp:active_iq_unified_manager
oracle:access_manager
oracle:agile_engineering_data_management
oracle:agile_product_lifecycle_management
oracle:application_performance_management
oracle:application_testing_suite
oracle:banking_apis
oracle:banking_digital_experience
oracle:banking_enterprise_default_management
oracle:banking_enterprise_default_managment
oracle:banking_party_management
oracle:banking_platform
oracle:blockchain_platform
oracle:commerce_guided_search
oracle:communications_application_session_controller
oracle:communications_billing_and_revenue_management_elastic_charging_engine
oracle:communications_cloud_native_core_network_repository_function
oracle:communications_cloud_native_core_policy
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_contacts_server
oracle:communications_converged_application_server_-_service_controller
oracle:communications_convergence
oracle:communications_design_studio
oracle:communications_diameter_intelligence_hub
oracle:communications_interactive_session_recorder
oracle:communications_offline_mediation_controller
oracle:communications_order_and_service_management
oracle:communications_policy_management
oracle:communications_pricing_design_center
oracle:communications_service_broker
oracle:enterprise_communications_broker
oracle:enterprise_session_border_controller
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_model_management_and_governance
oracle:flexcube_core_banking
oracle:fusion_middleware_mapviewer
oracle:health_sciences_data_management_workbench
oracle:health_sciences_information_manager
oracle:healthcare_data_repository
oracle:helidon
oracle:insurance_policy_administration
oracle:insurance_rules_palette
oracle:oss_support_tools
oracle:primavera_unifier
oracle:real_user_experience_insight
oracle:rest_data_services
oracle:retail_assortment_planning
oracle:retail_integration_bus

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-gwrp-pvrq-jmwv	Maven	commons-io:commons-io	<2.7	2.7
GHSA-gwrp-pvrq-jmwv	Maven	com.cosium.vet:vet	>=1.0 <=3.22	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	com.diamondq.common:common-thirdparty.jcasbin	1.4.0	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	com.liferay:com.liferay.sass.compiler.jsass	1.0.1	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	com.virjar:ratel-api	>=1.0.0 <=1.3.6	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	net.hasor:cobble-lang	>=4.4.1 <=4.6.2	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	org.apache.commons:commons-io	1.3.2	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io	>=1.4 <=1.5	no fix published
GHSA-gwrp-pvrq-jmwv	Maven	org.checkerframework.annotatedlib:commons-io	>=2.6 <2.7	2.7
GHSA-gwrp-pvrq-jmwv	Maven	org.smartboot.servlet:servlet-core	>=0.1.9 <=0.6	no fix published

References

Check your stack JSON