CVE catalog

CVE-2021-29425

Severity: Medium · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: Apr 12, 2021, 12:00:00 AM UTC
Updated: Aug 25, 2026, 4:28:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 10.55% · Oct 25, 2026

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	commons-io	sid	`2.22.0-1`	fixed
Debian	commons-io	forky	`2.22.0-1`	fixed
Debian	commons-io	trixie	`2.19.0-1`	fixed
Debian	commons-io	bookworm	`2.11.0-2`	fixed
Cpe	commons_io	Not reported	Not reported	unknown
Cpe	commons_io	Not reported	Not reported	unknown
Cpe	commons_io	Not reported	Not reported	unknown
Cpe	commons_io	Not reported	Not reported	unknown
Cpe	debian_linux	Not reported	Not reported	unknown
Cpe	access_manager	Not reported	Not reported	unknown
Cpe	access_manager	Not reported	Not reported	unknown
Cpe	agile_engineering_data_management	Not reported	Not reported	unknown
Cpe	agile_product_lifecycle_management	Not reported	Not reported	unknown
Cpe	application_performance_management	Not reported	Not reported	unknown
Cpe	application_testing_suite	Not reported	Not reported	unknown
Cpe	banking_apis	Not reported	Not reported	unknown
Cpe	banking_apis	Not reported	Not reported	unknown
Cpe	banking_apis	Not reported	Not reported	unknown
Cpe	banking_apis	Not reported	Not reported	unknown
Cpe	banking_apis	Not reported	Not reported	unknown
Ubuntu	commons-io	18.04	`2.5-1`	vulnerable
Ubuntu	commons-io	18.04	`2.5-2`	vulnerable
Ubuntu	commons-io	18.04	`2.6-1`	vulnerable
Ubuntu	commons-io	18.04	`2.6-2`	vulnerable
Ubuntu	commons-io	18.04	`2.6-2ubuntu0.18.04.1`	fixed
Ubuntu	commons-io	20.04	`2.6-2`	vulnerable
Ubuntu	commons-io	20.04	`2.6-2ubuntu0.20.04.1`	fixed
Ubuntu	commons-io	pro	`2.4-2`	vulnerable
Ubuntu	commons-io	pro	`2.4-2ubuntu0.16.04.1~esm1`	vulnerable
Ubuntu	commons-io	18.04	`2.5-1`	vulnerable
Ubuntu	commons-io	18.04	`2.5-2`	vulnerable
Ubuntu	commons-io	18.04	`2.6-1`	vulnerable
Ubuntu	commons-io	18.04	`2.6-2`	vulnerable
Ubuntu	commons-io	18.04	`2.6-2ubuntu0.18.04.1`	fixed
Ubuntu	commons-io	20.04	`2.6-2`	vulnerable
Ubuntu	commons-io	20.04	`2.6-2ubuntu0.20.04.1`	fixed
Suse	apache-commons-io	linux enterprise module for basesystem 15 sp2	`2.6-3.3.1`	fixed
Suse	apache-commons-io	linux enterprise software development kit 12 sp5	`2.4-9.3.1`	fixed
Suse	apache-commons-io	linux enterprise server 12 sp5	`2.4-9.3.1`	fixed
Suse	apache-commons-io	linux enterprise server for sap applications 12 sp5	`2.4-9.3.1`	fixed
Opensuse	apache-commons-io	leap 15.2	`2.6-lp152.2.3.1`	fixed
Opensuse	apache-commons-io	tumbleweed	`2.11.0-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	commons-io	source	sid	`2.8.0-1`	not yet assigned	Not reported	Not reported
Debian	commons-io	source	forky	`2.8.0-1`	not yet assigned	Not reported	Not reported
Debian	commons-io	source	trixie	`2.8.0-1`	not yet assigned	Not reported	Not reported
Debian	commons-io	source	bookworm	`2.8.0-1`	not yet assigned	Not reported	Not reported
Ubuntu	commons-io	deb	18.04	`2.6-2ubuntu0.18.04.1`	Not reported	USN-5095-1	Not reported
Ubuntu	commons-io	deb	20.04	`2.6-2ubuntu0.20.04.1`	Not reported	USN-5095-1	Not reported
Ubuntu	commons-io	deb	18.04	`2.6-2ubuntu0.18.04.1`	Not reported	UBUNTU-CVE-2021-29425	Not reported
Ubuntu	commons-io	deb	20.04	`2.6-2ubuntu0.20.04.1`	Not reported	UBUNTU-CVE-2021-29425	Not reported
Suse	apache-commons-io	rpm	linux enterprise module for basesystem 15 sp2	`2.6-3.3.1`	Not reported	SUSE-SU-2021:1282-1	Not reported
Suse	apache-commons-io	rpm	linux enterprise software development kit 12 sp5	`2.4-9.3.1`	Not reported	SUSE-SU-2021:1315-1	Not reported
Suse	apache-commons-io	rpm	linux enterprise server 12 sp5	`2.4-9.3.1`	Not reported	SUSE-SU-2021:1315-1	Not reported
Suse	apache-commons-io	rpm	linux enterprise server for sap applications 12 sp5	`2.4-9.3.1`	Not reported	SUSE-SU-2021:1315-1	Not reported
Opensuse	apache-commons-io	rpm	leap 15.2	`2.6-lp152.2.3.1`	Not reported	OPENSUSE-SU-2021:0605-1	Not reported
Opensuse	apache-commons-io	rpm	tumbleweed	`2.11.0-2.1`	Not reported	OPENSUSE-SU-2024:12099-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[apache-commons-io-javadoc]Unknown
Source package: [apache-commons-io]
Details (1)
- 2.22.0-1.3 · noarch · tumbleweed
  Unknown · Fixed: 2.11.0-2.1
  Version impact unknown
  nvd · apache-commons-io · opensuse · tumbleweed
[apache-commons-io]Fixed
Source package: [apache-commons-io]
Details (1)
- 2.22.0-1.3 · noarch · tumbleweed
  Fixed · Fixed: 2.11.0-2.1
  nvd · apache-commons-io · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libcommons-io-java]Fixed
Source package: [commons-io]
Details (2)
- 2.11.0-2 · all · bookworm
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · bookworm; nvd · commons-io · debian · 12
- 2.11.0-2 · all · bookworm
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · bookworm; nvd · commons-io · debian · 12
[libcommons-io-java-doc]Fixed
Source package: [commons-io]
Details (2)
- 2.11.0-2 · all · bookworm
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · bookworm; nvd · commons-io · debian · 12
- 2.11.0-2 · all · bookworm
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · bookworm; nvd · commons-io · debian · 12

[Debian 13 (Trixie)]

[libcommons-io-java]Fixed
Source package: [commons-io]
Details (2)
- 2.19.0-1 · all · trixie
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · 13
- 2.19.0-1 · all · trixie
  Fixed · Fixed: 2.8.0-1
  nvd · commons-io · debian · 13

Observed: Oct 23, 2026, 5:56:12 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]