CVE-2025-27553

Summary

CVE-2025-27553 is a Relative Path Traversal vulnerability affecting Apache Commons VFS before version 2.10.0. The FileObject API in Commons VFS includes a 'resolveFile' method with a 'scope' parameter, which is intended to return file objects that are descendants of the base file. However, if the path contains encoded ".." characters, such as "%2E%2E/bar.txt", the method may return file objects that are not descendants of the base file, without throwing an exception. This issue poses a security risk, and users are advised to upgrade to version 2.10.0, which addresses the vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.