Path Traversal and Improper Input Validation in Apache Commons IO

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Vulnerability ID: GHSA-gwrp-pvrq-jmwv
Aliases: CVE-2021-29425
Published: 2021-04-26 16:04:00
CWE: CWE-20
CWE-22
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: commons-io:commons-io
package: ecosystem: Maven
name: com.cosium.vet:vet
package: ecosystem: Maven
name: com.diamondq.common:common-thirdparty.jcasbin
package: ecosystem: Maven
name: com.liferay:com.liferay.sass.compiler.jsass
package: ecosystem: Maven
name: com.virjar:ratel-api
package: ecosystem: Maven
name: net.hasor:cobble-lang
package: ecosystem: Maven
name: org.apache.commons:commons-io
package: ecosystem: Maven
name: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io
package: ecosystem: Maven
name: org.checkerframework.annotatedlib:commons-io
package: ecosystem: Maven
name: org.smartboot.servlet:servlet-core