Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2016-1000031

FileUpload: DiskFileItem file manipulation

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

CVSS 3.1 · 9.8 Critical EPSS 32.7% KEV · Not listed
Vendors
Apache
Products
Commons Fileupload
CVE-2013-0248

apache-commons-fileupload: /tmp directory used by default for uploaded files (possibility to overwrite arbitrary files)

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Commons Fileupload
CVE-2016-3092

tomcat: Usage of vulnerable FileUpload package can result in denial of service

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

CVSS 3.1 · 7.5 High EPSS 37.2% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Commons Fileupload Tomcat Ubuntu Linux and 6 more
CVE-2014-0050

apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

CVSS 3.1 · 7.5 High EPSS 83.3% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Commons Fileupload Tomcat Retail Applications and 13 more
CVE-2023-24998

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

CVSS 3.1 · 7.5 High EPSS 48.8% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Commons Fileupload Debian Linux Camel Spring Boot and 4 more
CVE-2025-48976

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

CVSS 3.1 · 7.5 High EPSS 34.0% KEV · Not listed
Vendors
Apache
Products
Commons Fileupload