Apache Commons Fileupload vulnerabilities

6 CVEs affecting Apache Commons Fileupload, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-48976, published 2025-06-16.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-0050, published 2014-04-01. High severity, CVSS 7.5. EPSS: 83.3% chance of exploitation in the next 30 days. MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU…
• CVE-2023-24998, published 2023-02-20. High severity, CVSS 7.5. EPSS: 48.8% chance of exploitation in the next 30 days. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of…
• CVE-2016-3092, published 2016-07-04. High severity, CVSS 7.5. EPSS: 37.2% chance of exploitation in the next 30 days. The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products,…
• CVE-2016-1000031, published 2016-10-25. Critical severity, CVSS 9.8. EPSS: 33.7% chance of exploitation in the next 30 days. Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
• CVE-2025-48976, published 2025-06-16. High severity, CVSS 7.5. EPSS: 33% chance of exploitation in the next 30 days. Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6;…
• CVE-2013-0248, published 2013-03-15. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary…