| Package | Affected versions | Patched versions |
|---|---|---|
| commons-fileupload:commons-fileupload | ≥ 1.0, < 1.2.2 | 1.2.2 |
| commons fileupload | = 1.0= 1.1= 1.1.1= 1.2= 1.2.1= 1.2.2 |
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free