CVE-2013-0248: Apache Commons Fileupload

Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Affected products

• Apache Commons Fileupload: version 1.0 only; version 1.1 only; version 1.1.1 only; version 1.2 only; version 1.2.1 only; version 1.2.2 only

Published 2013-03-15. Last modified 2026-10-07.