CVE-2021-29425

Medium

Elevated severity or exploit probability.

CVSS base

4.8 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — probability of exploitation (30 days)

10.2%

95.5th percentile

CISA KEV

Not listed

Weakness / dates

CWE-22

Published 2021-04-13 · modified 2026-08-25

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector	N	Network
Attack Complexity	H	High
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	L	Low
Integrity	L	Low
Availability	N	None

Timeline

2021-04-13 — Published (NVD)
2026-08-25 — Last modified (NVD)

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Affected

apache debian oracle

References

Official: NVD · CVE.org