Apache Commons VFS Hat eine Relative Path Traversal Schwachstelle

The vulnerability lies in the resolveFile method within the FileObject API of Apache Commons VFS. When a path containing encoded ".." characters (e.g., "%2E%2E/bar.txt") is provided, the method may fail to properly validate that the resolved file is a descendant of the base file. Instead of throwing an exception as intended, it might return file objects outside the intended scope, granting attackers access to files they shouldn't be able to reach. This could allow attackers to read sensitive configuration files, source code, or other critical data stored on the system. The potential impact extends to any application utilizing Apache Commons VFS for file system operations, making it a widespread concern.

Applications and services that utilize Apache Commons VFS for file handling are at risk, particularly those that accept user-supplied file paths without proper validation. This includes web applications, file servers, and data processing pipelines. Legacy systems relying on older versions of Commons VFS are especially vulnerable.

• java / server:

find /path/to/your/app -name "commons-vfs2-*.jar" -print0 | xargs -0 jar -xf {} | grep -q 'resolveFile(String, NameScope)'

• generic web:

curl -I 'http://your-app/path/../sensitive_file.txt' # Check for directory traversal responses

1. 2025-03-23Disclosure

   disclosure

1. Reserviert2025-03-01
2. Veröffentlicht2025-03-23
3. Geändert2025-04-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-27553 is to upgrade to Apache Commons VFS version 2.10.0 or later, which addresses the vulnerability. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. These might include stricter input validation on file paths used with the resolveFile method, ensuring that all user-supplied path components are properly sanitized and normalized. Web Application Firewalls (WAFs) configured to detect and block requests containing encoded ".." sequences in file paths can also provide a layer of defense. After upgrading, confirm the fix by attempting to resolve a file outside the intended directory using a path containing encoded ".." characters; the operation should now throw an exception.