CVE-2025-27553

A Relative Path Traversal vulnerability exists in Apache Commons VFS before version 2.10.0 . The FileObject API 's resolveFile method fails to throw an exception when a path contains encoded ".." characters (e.g., %2E%2E/bar.txt) while using the NameScope.DESCENDENT scope, potentially allowing ac...

CVE-2025-27553 Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553 Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-30474 Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

CVE-2025-30474 Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

CVE-2025-30474

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

CVE-2025-30474

The Apache Commons VFS library (versions before 2.10.0 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Specifically, the FtpFileObject class can throw an exception when a file is not found, potentially revealing the original URI in the exc...

CVE-2025-30474

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

CVE-2025-27553: Relative Path Traversal

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-30474: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

PT-2025-12536

Name of the Vulnerable Software and Affected Versions Apache Commons VFS versions prior to 2.10.0 Description The issue is related to the exposure of sensitive information to an unauthorized actor in Apache Commons VFS. Specifically, the FtpFileObject class can throw an exception when a file is n...

PT-2025-16710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue occurs when a 9p tree is mounted with the 'posixacl' option and a subdirectory is created. This happens because the v9fs fid add call in the v9fs vfs mkd...

ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read

...

Linux Distros Unpatched Vulnerability : CVE-2015-1350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege...

PT-2025-12535

Name of the Vulnerable Software and Affected Versions: Apache Commons VFS versions prior to 2.10.0 Description: The FileObject API in Commons VFS has a resolveFile method that takes a scope parameter. Specifying NameScope.DESCENDENT promises that an exception is thrown if the resolved file is not...

UBUNTU-CVE-2022-49705

In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid refcount leak in v9fsvfsatomicopendotl We need to release directory fid if we fail halfway through open This fixes fid leaking with xfstests generic 531...

CVE-2022-49584

CVE-2022-49584 is a Linux kernel issue in the ixgbe driver where disabling SR-IOV (setting sriov_numvfs to zero) can race with the PF driver, potentially causing a kernel panic. The root cause is a lack of locking during the disable path, allowing VF mailbox communication to proceed concurrently....

PT-2025-8637

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified, related to the 9p protocol. The problem occurs because the protocol version check is performed after obtaining a fid, which can lead to a...

PT-2025-8638

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been resolved, specifically a fid refcount leak in v9fs vfs atomic open dotl. The leak occurs when the directory fid is not released if the open operation...