MavenPackage

commons-fileupload:commons-fileupload

7 known vulnerabilities (1 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 1.6.0 (Jun 5, 2025): no advisory affects it
Newest unaffected release: 1.6.0 (Jun 5, 2025), the latest release
Advisories: 7 · 1 critical, 4 high, 1 medium

Dependents: 2,016
Releases: 17 since 1.0 (Nov 22, 2005)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-48976
Affects 1.0 to 1.5 (1.6.0 is outside it)
CVE-2023-24998
Affects 1.0-beta-1 to 1.4 (1.5 is outside it)
CVE-2016-1000031
Affects 1.0-beta-1 to 1.3.2 (1.3.3 is outside it)
CVE-2016-3092
Affects 1.0-beta-1 to 1.3.1-jenkins-2 (1.3.2 is outside it)
CVE-2014-0050
Affects 1.0-beta-1 to 1.3 (1.3.1 is outside it)
CVE-2013-2186
Affects 1.0-beta-1 to 1.3 (1.3.1 is outside it)
CVE-2013-0248
Affects 1.0 to 1.2.1 (1.2.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2025-48976High 7.5
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
Affected: from 1.0, fixed in 1.6; from 1.0, fixed in 1.6.0.
Fixed in 1.6.0 (released Jun 5, 2025, 11 days before disclosure).
The latest release, 1.6.0, is not affected.
CVE-2023-24998High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Affected: fixed in 1.5.
Fixed in 1.5 (released Feb 1, 2023, 19 days before disclosure).
The latest release, 1.6.0, is not affected.
CVE-2016-1000031Critical 9.8
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Affected: fixed in 1.3.3.
Fixed in 1.3.3 (released Jun 9, 2017, 227 days after disclosure).
The latest release, 1.6.0, is not affected.
CVE-2016-3092High 7.5
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 23, 2016, 42 days before disclosure).
The latest release, 1.6.0, is not affected.
CVE-2014-0050High 7.5
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attac
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Feb 6, 2014, 50 days before disclosure).
The latest release, 1.6.0, is not affected.
CVE-2013-2186Unrated
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red…
Affected: fixed in 1.3.1.
Fixed in 1.3.1 (released Feb 6, 2014, 101 days after disclosure).
The latest release, 1.6.0, is not affected.
CVE-2013-0248Medium 6.8
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for upload
Affected: from 1.0, fixed in 1.2.2.
Fixed in 1.2.2 (released Jul 29, 2010, 960 days before disclosure).
The latest release, 1.6.0, is not affected.