[SECURITY] [DLA 4111-1] commons-vfs security update

Debian LTS Advisory DLA-4111-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany April 02, 2025 https://wiki.debian.org/LTS Package : commons-vfs Version : 2.1-2+deb11u1 CVE ID : CVE-2025-27553 Debian Bug : 1101204 Arnout Engelen discovered a Relative Path Traversal...

CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements...

CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements...

CVE-2023-40714

FortiSIEM contains a relative path traversal in the file upload/GUI elements component that can escalate privileges. Affected versions: 6.5.0–6.5.1 (upgrade to 6.5.2+), 6.6.0–6.6.3 (upgrade to 6.6.4+), 6.7.0–6.7.2 (upgrade to 6.7.4+), and 7.0.0 (upgrade to 7.0.1+). Workarounds include restricting...

Debian dla-4111 : libcommons-vfs-java - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4111 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4111-1 [email protected] https://www.debian.org/lts/security/...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal through the rendermav function. An attacker can access or modify files on the server by manipulating the input to traverse outside the intended directory structure. Remediation Upgrade org.noear:solon-view-beetl ...

SUSE CVE-2009-0848

Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."...

SUSE CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

The vulnerability of the resolveFile method in the unified API for accessing various file systems in Apache Commons VFS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the resolveFile method in the unified API for accessing various file systems using Apache Commons VFS is related to errors in processing the relative path to the directory when handling the scope parameter. Exploiting this vulnerability could allow an attacker to gain...

Relative Path Traversal

mlflow is vulnerable to Relative Path Traversal. The vulnerability is due to improper URL handling due to the dbfs service concatenating URLs directly into the file protocol, allowing arbitrary file reads when the service is mounted to a local directory...

Apache Commons VFS Has Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

GHSA-9Q4X-FR4M-JP86 Apache Commons VFS Has Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the resolveFile method when the scope parameter is set to NameScope.DESCENDENT. An attacker can access files outside of the intended directory by including encoded directory traversal sequences such as %2E%2E...

CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

UBUNTU-CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553

CVE-2025-27553: Relative Path Traversal in Apache Commons VFS (FileObject.resolveFile with NameScope.DESCENDENT) can bypass descendent checks when paths contain encoded ".."; affected up to Commons VFS 2.9.x, fixed in 2.10.0. IBM bulletin aligns this vulnerability with IBM Content Collector for S...

CVE-2024-8769

A vulnerability in the LockManager.releaselocks function in aimhubio/aim commit bb76afe allows for arbitrary file deletion through relative path traversal. The runhash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. Thi...

Relative Path Traversal

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Relative Path Traversal through the save-workflow functionality. An attacker can write arbitrary JSON files on the filesystem by exploiting this vulnerability. PoC...

Relative Path Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Relative Path Traversal through the runs/delete-batch endpoint. An attacker can delete arbitrary files or directories, potentially causing denial of service or data...