Known vulnerabilities in Apache Commons FileUpload

Vendor: Apache Foundation
Software: Apache Commons FileUpload
Software CPE: cpe:2.3:a:apache_foundation:fileupload:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 7
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Commons FileUpload Apache Commons FileUpload is affected by 7 known vulnerabilities: 2 high, 4 medium, 1 low Critical High Medium Low

Vulnerabilities (7)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU111162 - Resource exhaustion
CVE-2025-48976		 CWE-400 Medium
Available
No
 1.6.0, 2.0.0-M4 16.06.2025 SB2025061634
SB2025061635
SB2025061927
and 156 more
#VU81098 - Improper input validation
CVE-2013-2186		 CWE-20 High
No
No
 1.2.2 25.09.2023 SB2013102803
SB2023092623
SB2023101310
and 3 more
#VU72427 - Allocation of Resources Without Limits or Throttling
CVE-2023-24998		 CWE-770 Medium
Available
No
 1.5 20.02.2023 SB2023022046
SB2023022047
SB2023030917
and 202 more
#VU54943 - UNIX Symbolic Link (Symlink) Following
CVE-2013-0248		 CWE-61 Low
No
No
 1.3 19.07.2021 SB2013031514
SB2021071906
SB2021120215
and 4 more
#VU12312 - Deserialization of Untrusted Data
CVE-2016-1000031		 CWE-502 High
No
No
 1.3.3 01.05.2018 SB2017111432
SB2018110601
SB2019051512
and 39 more
#VU5233 - Resource exhaustion
CVE-2014-0050		 CWE-400 Medium
Available
No
 1.3.1 23.01.2017 SB2014020601
SB2015092620
SB2014041701
and 12 more
#VU197 - Resource exhaustion
CVE-2016-3092		 CWE-400 Medium
No
No
 1.3.2 22.07.2016 SB2016070602
SB2016070203
SB2016063002
and 20 more