CVE-2025-27553

🗓️ 23 Mar 2025 14:16:20Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 156 Views🌐 WEB

Relative Path Traversal vulnerability in Apache Commons VFS before version 2.10.0 requires upgrade.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS, which affects IBM watsonx.data	1 Sep 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities reported in YAJSW service shipped in IBM WebSphere eXtreme Scale Liberty Deployment	14 Oct 202518:10	–	ibm
Tenable Nessus	Amazon Linux 2 : apache-commons-vfs (ALAS-2025-2842)	30 Apr 202500:00	–	nessus
Tenable Nessus	Debian dla-4111 : libcommons-vfs-java - security update	2 Apr 202500:00	–	nessus
Tenable Nessus	IBM WebSphere eXtreme Scale 8.6.1.0 < 8.6.1.6 (7247893)	14 Oct 202500:00	–	nessus
Tenable Nessus	Oracle Linux 7 : apache-commons-vfs (ELSA-2025-10548)	23 Jul 202500:00	–	nessus
Tenable Nessus	Oracle Primavera Gateway (October 2025 CPU)	23 Oct 202500:00	–	nessus
Tenable Nessus	RHEL 7 : apache-commons-vfs (RHSA-2025:10548)	8 Jul 202500:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : apache-commons-vfs2 (SUSE-SU-2025:1022-1)	27 Mar 202500:00	–	nessus
Tenable Nessus	TencentOS Server 2: apache-commons-vfs (TSSA-2025:0598)	20 Nov 202500:00	–	nessus

NVD

Vulners

Node

apache commons_vfsRange<2.10.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.commons:commons-vfs2",
    "product": "Apache Commons VFS",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.10.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb
lists	www.lists.debian.org/debian-lts-announce/2025/04/msg00006.html
openwall	www.openwall.com/lists/oss-security/2025/03/23/1

Parameter	Position	Path	Description	CWE
path	path	%2E%2E/bar.txt	Relative path traversal via encoded '..' in path passed to resolveFile can bypass descendent checks in Apache Commons VFS (CWE-23).	CWE-23

17 Jun 2026 09:03Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.01277

SSVC

CWE-23