https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 20:20:55 +0000 https://vulnerability.circl.lu/vuln/ghsa-gwrp-pvrq-jmwv <p><strong>Affected:</strong> Maven: commons-io:commons-io, Maven: com.cosium.vet:vet, Maven: com.diamondq.common:common-thirdparty.jcasbin, Maven: com.liferay:com.liferay.sass.compiler.jsass, Maven: com.virjar:ratel-api, Maven: net.hasor:cobble-lang, Maven: org.apache.commons:commons-io, Maven: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io, Maven: org.checkerframework.annotatedlib:commons-io, Maven: org.smartboot.servlet:servlet-core</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> <p><strong>Affected:</strong> Maven: commons-io:commons-io, Maven: com.cosium.vet:vet, Maven: com.diamondq.common:common-thirdparty.jcasbin, Maven: com.liferay:com.liferay.sass.compiler.jsass, Maven: com.virjar:ratel-api, Maven: net.hasor:cobble-lang, Maven: org.apache.commons:commons-io, Maven: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io, Maven: org.checkerframework.annotatedlib:commons-io, Maven: org.smartboot.servlet:servlet-core</p> <p>In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like &#34;//../foo&#34;, or &#34;\\..\foo&#34;, the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus &#34;limited&#34; path traversal), if the calling code would use the result to construct a path value.</p> https://vulnerability.circl.lu/vuln/ghsa-gwrp-pvrq-jmwv