CVE-2025-27553

A Relative Path Traversal vulnerability exists in Apache Commons VFS before version 2.10.0 . The FileObject API 's resolveFile method fails to throw an exception when a path contains encoded ".." characters (e.g., %2E%2E/bar.txt) while using the NameScope.DESCENDENT scope, potentially allowing ac...

CVE-2025-30474

The Apache Commons VFS library (versions before 2.10.0 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Specifically, the FtpFileObject class can throw an exception when a file is not found, potentially revealing the original URI in the exc...