Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/commons-fileupload/commons-fileupload@1.2.2
purl pkg:maven/commons-fileupload/commons-fileupload@1.2.2
Next non-vulnerable version 1.6.0
Latest non-vulnerable version 1.6.0
Risk 10.0
Vulnerabilities affecting this package (7)
Vulnerability Summary Fixed by
VCID-2x6a-3gh1-rkhs
Aliases:
CVE-2025-48976
GHSA-vv7r-c36w-3prj
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
1.6.0
Affected by 0 other vulnerabilities.
VCID-56jv-htmt-rkew
Aliases:
CVE-2023-24998
GHSA-hfrx-6qgj-fp6c
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
1.5
Affected by 1 other vulnerability.
VCID-d571-6zkc-jfdy
Aliases:
CVE-2016-1000031
GHSA-7x9j-7223-rg5m
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
1.3.3
Affected by 2 other vulnerabilities.
VCID-gv12-4ruf-kfhq
Aliases:
CVE-2014-0050
GHSA-xx68-jfcg-xmmf
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
1.3.1
Affected by 4 other vulnerabilities.
VCID-jc2q-ht2b-cfhx
Aliases:
CVE-2013-2186
GHSA-qx6h-9567-5fqw
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
1.3.1
Affected by 4 other vulnerabilities.
VCID-kqjy-kvpx-kub8
Aliases:
CVE-2013-0248
GHSA-vm69-474v-7q2w
/tmp directory used by default for uploaded files The default configuration of `javax.servlet.context.tempdir` in this package uses the `/tmp` directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
1.3
Affected by 6 other vulnerabilities.
VCID-pqxe-tfhk-47b7
Aliases:
CVE-2016-3092
GHSA-fvm3-cfvj-gxqq
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
1.3.2
Affected by 3 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-kqjy-kvpx-kub8 /tmp directory used by default for uploaded files The default configuration of `javax.servlet.context.tempdir` in this package uses the `/tmp` directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. CVE-2013-0248
GHSA-vm69-474v-7q2w

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T23:31:09.920762+00:00 GitLab Importer Affected by VCID-2x6a-3gh1-rkhs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2025-48976.yml 38.4.0
2026-04-16T22:22:26.910792+00:00 GitLab Importer Affected by VCID-56jv-htmt-rkew https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2023-24998.yml 38.4.0
2026-04-16T20:34:46.675200+00:00 GitLab Importer Affected by VCID-d571-6zkc-jfdy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2016-1000031.yml 38.4.0
2026-04-16T20:31:21.437853+00:00 GitLab Importer Affected by VCID-gv12-4ruf-kfhq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2014-0050.yml 38.4.0
2026-04-16T20:30:56.514488+00:00 GitLab Importer Affected by VCID-jc2q-ht2b-cfhx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-2186.yml 38.4.0
2026-04-16T20:30:28.631660+00:00 GitLab Importer Affected by VCID-kqjy-kvpx-kub8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-0248.yml 38.4.0
2026-04-16T01:26:20.912973+00:00 GHSA Importer Affected by VCID-d571-6zkc-jfdy https://github.com/advisories/GHSA-7x9j-7223-rg5m 38.4.0
2026-04-16T01:26:18.821612+00:00 GHSA Importer Affected by VCID-pqxe-tfhk-47b7 https://github.com/advisories/GHSA-fvm3-cfvj-gxqq 38.4.0
2026-04-12T00:50:56.869589+00:00 GitLab Importer Affected by VCID-2x6a-3gh1-rkhs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2025-48976.yml 38.3.0
2026-04-11T23:40:34.551833+00:00 GitLab Importer Affected by VCID-56jv-htmt-rkew https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2023-24998.yml 38.3.0
2026-04-11T21:45:17.120364+00:00 GitLab Importer Affected by VCID-d571-6zkc-jfdy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2016-1000031.yml 38.3.0
2026-04-11T21:41:42.451685+00:00 GitLab Importer Affected by VCID-gv12-4ruf-kfhq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2014-0050.yml 38.3.0
2026-04-11T21:41:20.251408+00:00 GitLab Importer Affected by VCID-jc2q-ht2b-cfhx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-2186.yml 38.3.0
2026-04-11T21:40:54.294727+00:00 GitLab Importer Affected by VCID-kqjy-kvpx-kub8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-0248.yml 38.3.0
2026-04-11T12:55:39.575673+00:00 GHSA Importer Affected by VCID-d571-6zkc-jfdy https://github.com/advisories/GHSA-7x9j-7223-rg5m 38.3.0
2026-04-11T12:55:37.430132+00:00 GHSA Importer Affected by VCID-pqxe-tfhk-47b7 https://github.com/advisories/GHSA-fvm3-cfvj-gxqq 38.3.0
2026-04-03T00:59:00.556796+00:00 GitLab Importer Affected by VCID-2x6a-3gh1-rkhs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2025-48976.yml 38.1.0
2026-04-02T23:44:37.554019+00:00 GitLab Importer Affected by VCID-56jv-htmt-rkew https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2023-24998.yml 38.1.0
2026-04-02T21:59:19.061228+00:00 GitLab Importer Affected by VCID-d571-6zkc-jfdy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2016-1000031.yml 38.1.0
2026-04-02T21:55:54.641201+00:00 GitLab Importer Affected by VCID-gv12-4ruf-kfhq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2014-0050.yml 38.1.0
2026-04-02T21:55:30.875490+00:00 GitLab Importer Affected by VCID-jc2q-ht2b-cfhx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-2186.yml 38.1.0
2026-04-02T21:55:03.053977+00:00 GitLab Importer Affected by VCID-kqjy-kvpx-kub8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-0248.yml 38.1.0
2026-04-02T13:48:10.149475+00:00 GHSA Importer Affected by VCID-d571-6zkc-jfdy https://github.com/advisories/GHSA-7x9j-7223-rg5m 38.1.0
2026-04-02T13:48:07.806621+00:00 GHSA Importer Affected by VCID-pqxe-tfhk-47b7 https://github.com/advisories/GHSA-fvm3-cfvj-gxqq 38.1.0
2026-04-01T18:07:38.037451+00:00 GitLab Importer Affected by VCID-56jv-htmt-rkew https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2023-24998.yml 38.0.0
2026-04-01T16:16:37.674401+00:00 GitLab Importer Affected by VCID-d571-6zkc-jfdy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2016-1000031.yml 38.0.0
2026-04-01T16:13:04.039390+00:00 GitLab Importer Affected by VCID-gv12-4ruf-kfhq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2014-0050.yml 38.0.0
2026-04-01T16:12:44.083392+00:00 GitLab Importer Affected by VCID-jc2q-ht2b-cfhx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-2186.yml 38.0.0
2026-04-01T16:00:45.538498+00:00 GHSA Importer Fixing VCID-kqjy-kvpx-kub8 https://github.com/advisories/GHSA-vm69-474v-7q2w 38.0.0
2026-04-01T13:07:47.916438+00:00 GithubOSV Importer Fixing VCID-kqjy-kvpx-kub8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vm69-474v-7q2w/GHSA-vm69-474v-7q2w.json 38.0.0
2026-04-01T12:46:48.703413+00:00 GitLab Importer Affected by VCID-kqjy-kvpx-kub8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-0248.yml 38.0.0