CVE-2013-0248
Fixed in a distro release EPSS <1%CVSS 6.8
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Products: apache commons_fileupload
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | commons-fileupload:commons-fileupload | 1.2.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libcommons-fileupload-java | 1.3-1 |
| Debian 13 | libcommons-fileupload-java | 1.3-1 |
| Debian 14 | libcommons-fileupload-java | 1.3-1 |