https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:21:14 +0000 https://vulnerability.circl.lu/vuln/cve-2025-27553 <p><strong>Affected:</strong> Apache Software Foundation Apache Commons VFS</p> <p>Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.</p> <p>The FileObject API in Commons VFS has a &#39;resolveFile&#39; method that takes a &#39;scope&#39; parameter. Specifying &#39;NameScope.DESCENDENT&#39; promises that &#34;an exception is thrown if the resolved file is not a descendent of the base file&#34;. However, when the path contains encoded &#34;..&#34; characters (for example, &#34;%2E%2E/bar.txt&#34;), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.</p> <p>Users are recommended to upgrade to version 2.10.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Commons VFS</p> <p>Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.</p> <p>The FileObject API in Commons VFS has a &#39;resolveFile&#39; method that takes a &#39;scope&#39; parameter. Specifying &#39;NameScope.DESCENDENT&#39; promises that &#34;an exception is thrown if the resolved file is not a descendent of the base file&#34;. However, when the path contains encoded &#34;..&#34; characters (for example, &#34;%2E%2E/bar.txt&#34;), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.</p> <p>Users are recommended to upgrade to version 2.10.0, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2025-27553