Possible limited path traversal vulnerabily in Apache Commons IO

Summary

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Timeline

1. Apr 13, 2021, 6:50 AM UTCCVE published
2. Oct 7, 2026, 6:15 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 7, 2026, 6:16 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Commons IO

  Apache Commons IO 2.2, Apache Commons IO 2.3, Apache Commons IO 2.4, Apache Commons IO 2.5, Apache Commons IO 2.6

• commons-io:commons-ioMaven

  fixed in 2.7

• com.cosium.vet:vetMaven

  From 1.0 · through 3.22

• com.diamondq.common:common-thirdparty.jcasbinMaven

  1.4.0

• com.liferay:com.liferay.sass.compiler.jsassMaven

  1.0.1

• com.virjar:ratel-apiMaven

  From 1.0.0 · through 1.3.6

• net.hasor:cobble-langMaven

  From 4.4.1 · through 4.6.2

• org.apache.commons:commons-ioMaven

  1.3.2

• org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-ioMaven

  From 1.4 · through 1.5

• org.checkerframework.annotatedlib:commons-ioMaven

  From 2.6 · fixed in 2.7

• org.smartboot.servlet:servlet-coreMaven

  From 0.1.9 · through 0.6

References 25