CVE-2021-29425: Apache Commons Io

Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days.

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Affected products

Apache Commons Io: version 2.2 only; version 2.3 only; version 2.4 only; version 2.5 only; version 2.6 only
Debian Debian Linux: version 9.0 only
Netapp Active Iq Unified Manager: affected versions not specified
Oracle Access Manager: version 11.1.2.3.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Agile Product Lifecycle Management: version 9.3.6 only
Oracle Application Performance Management: version 13.4.1.0 only; version 13.5.1.0 only
Oracle Application Testing Suite: version 13.3.0.1 only
Oracle Banking Apis: version 18.1 only; version 18.2 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only; …
Oracle Banking Digital Experience: version 17.2 only; version 18.1 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only; …
Oracle Banking Enterprise Default Management: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.10.0 only; version 2.12.0 only
Oracle Banking Enterprise Default Managment: from 2.3.0, up to and including 2.4.0
Oracle Banking Party Management: version 2.7.0 only
Oracle Banking Platform: from 2.3.0, up to and including 2.4.1; version 2.6.2 only; version 2.7.0 only; version 2.7.1 only
Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
Oracle Commerce Guided Search: version 11.3.2 only
Oracle Communications Application Session Controller: version 3.9.0 only
Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 11.3 only; version 12.0 only
Oracle Communications Cloud Native Core Network Repository Function: version 1.14.0 only
Oracle Communications Cloud Native Core Policy: version 1.14.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
Oracle Communications Contacts Server: version 8.0.0.6.0 only
Oracle Communications Converged Application Server - Service Controller: version 6.2 only
Oracle Communications Convergence: version 3.0.2.2.0 only
Oracle Communications Design Studio: from 7.4.0, up to and including 7.4.2; version 7.3.5 only
and 35 more

Published 2021-04-13. Last modified 2026-10-07.