VulnerableCode Package Details - pkg:maven/commons-fileupload/commons-fileupload@1-alpha0

Search for packages

Package details: pkg:maven/commons-fileupload/commons-fileupload@1-alpha0

Essentials
History (2)

purl	pkg:maven/commons-fileupload/commons-fileupload@1-alpha0
Tags	Ghost

Next non-vulnerable version	1.6.0
Latest non-vulnerable version	1.6.0
Risk	10.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-2xqq-rzns-r7gz Aliases: CVE-2013-0248 GHSA-vm69-474v-7q2w	Incorrect Default Permissions in Apache Commons FileUpload The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.	1.2.2 Affected by 7 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 1.3 Affected by 6 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-tkcj-p17z-6fe3 Aliases: CVE-2013-2186 GHSA-qx6h-9567-5fqw		1.3.1 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-2xqq-rzns-r7gz
Aliases:
CVE-2013-0248
GHSA-vm69-474v-7q2w

Incorrect Default Permissions in Apache Commons FileUpload The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

1.2.2
Affected by 7 other vulnerabilities.

1.3
Affected by 6 other vulnerabilities.

VCID-tkcj-p17z-6fe3
Aliases:
CVE-2013-2186
GHSA-qx6h-9567-5fqw

1.3.1
Affected by 4 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T09:21:04.164383+00:00	GitLab Importer	Affected by	VCID-tkcj-p17z-6fe3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-2186.yml	37.0.0
2025-07-31T09:21:00.194945+00:00	GitLab Importer	Affected by	VCID-2xqq-rzns-r7gz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-fileupload/commons-fileupload/CVE-2013-0248.yml	37.0.0