Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/commons-io@1.4-3
purl pkg:deb/debian/commons-io@1.4-3
Next non-vulnerable version 2.19.0-1
Latest non-vulnerable version 2.19.0-1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-msck-u3y4-tqcn
Aliases:
CVE-2021-29425
GHSA-gwrp-pvrq-jmwv
Path Traversal and Improper Input Validation in Apache Commons IO In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
2.8.0-1
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-15T18:32:17.340260+00:00 Debian Oval Importer Affected by VCID-msck-u3y4-tqcn https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.4.0
2026-04-11T18:17:04.912280+00:00 Debian Oval Importer Affected by VCID-msck-u3y4-tqcn https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.3.0
2026-04-08T18:03:14.617914+00:00 Debian Oval Importer Affected by VCID-msck-u3y4-tqcn https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.1.0