{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-08T16:47:27.898","vulnerabilities":[{"cve":{"id":"CVE-2025-27553","sourceIdentifier":"security@apache.org","published":"2025-03-23T15:15:13.377","lastModified":"2025-04-02T22:15:19.203","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue."},{"lang":"es","value":"Vulnerabilidad de Path Traversal relativo en Apache Commons VFS anterior a la versión 2.10.0. La API FileObject de Commons VFS incluye un método \"resolveFile\" que utiliza el parámetro \"scope\". Especificar \"NameScope.DESCENDENT\" implica que se lanzará una excepción si el archivo resuelto no es descendiente del archivo base. Sin embargo, si la ruta contiene caracteres \"..\" codificados (por ejemplo, \"%2E%2E/bar.txt\"), podría devolver objetos de archivo que no son descendientes del archivo base, sin lanzar una excepción. Este problema afecta a Apache Commons VFS anterior a la versión 2.10.0. Se recomienda actualizar a la versión 2.10.0, que soluciona el problema."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:commons_vfs:*:*:*:*:*:*:*:*","versionEndExcluding":"2.10.0","matchCriteriaId":"4BABF8CF-5800-484E-9B46-701503CA903B"}]}]}],"references":[{"url":"https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/23/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00006.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}