# commons-fileupload:commons-fileupload (Maven) vulnerabilities 7 known vulnerabilities (1 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.6.0 (Jun 5, 2025): no advisory affects it - Newest unaffected release: 1.6.0 (Jun 5, 2025), the latest release - Dependents: 2,016 - Releases: 17 since 1.0 (Nov 22, 2005) - Registry: https://central.sonatype.com/artifact/commons-fileupload/commons-fileupload - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-48976: 1.0 to 1.5 (1.6.0 is outside it) - CVE-2023-24998: 1.0-beta-1 to 1.4 (1.5 is outside it) - CVE-2016-1000031: 1.0-beta-1 to 1.3.2 (1.3.3 is outside it) - CVE-2016-3092: 1.0-beta-1 to 1.3.1-jenkins-2 (1.3.2 is outside it) - CVE-2014-0050: 1.0-beta-1 to 1.3 (1.3.1 is outside it) - CVE-2013-2186: 1.0-beta-1 to 1.3 (1.3.1 is outside it) - CVE-2013-0248: 1.0 to 1.2.1 (1.2.2 is outside it) ## Advisories (7) ### [CVE-2025-48976](https://cve.now/CVE-2025-48976): Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers - Severity: High 7.5 - Published: Jun 16, 2025 - Affected: from 1.0, fixed in 1.6; from 1.0, fixed in 1.6.0. - Fixed in 1.6.0 (released Jun 5, 2025, 11 days before disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2023-24998](https://cve.now/CVE-2023-24998): Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts - Severity: High 7.5 - Published: Feb 20, 2023 - Affected: fixed in 1.5. - Fixed in 1.5 (released Feb 1, 2023, 19 days before disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2016-1000031](https://cve.now/CVE-2016-1000031): Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution - Severity: Critical 9.8 - Published: Oct 25, 2016 - Affected: fixed in 1.3.3. - Fixed in 1.3.3 (released Jun 9, 2017, 227 days after disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2016-3092](https://cve.now/CVE-2016-3092): The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be - Severity: High 7.5 - Published: Jul 4, 2016 - Affected: fixed in 1.3.2. - Fixed in 1.3.2 (released May 23, 2016, 42 days before disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2014-0050](https://cve.now/CVE-2014-0050): MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attac - Severity: High 7.5 - Published: Mar 28, 2014 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Feb 6, 2014, 50 days before disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2013-2186](https://cve.now/CVE-2013-2186): The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red… - Severity: Unrated - Published: Oct 28, 2013 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Feb 6, 2014, 101 days after disclosure). - The latest release, 1.6.0, is not affected. ### [CVE-2013-0248](https://cve.now/CVE-2013-0248): The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for upload - Severity: Medium 6.8 - Published: Mar 15, 2013 - Affected: from 1.0, fixed in 1.2.2. - Fixed in 1.2.2 (released Jul 29, 2010, 960 days before disclosure). - The latest release, 1.6.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/commons-fileupload:commons-fileupload Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.