What is the CVSS score of CVE-2025-27553?

CVE-2025-27553 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Commons Vfs are affected by CVE-2025-27553?

Organizations using Apache Commons VFS face notable risk from CVE-2025-27553 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-27553?

Within 7 days: Identify all affected systems running Apache Commons VFS and apply vendor patches promptly. Monitor vendor channels for patch availability.

Commons Vfs CVE-2025-27553

HIGH

Relative Path Traversal (CWE-23)

2025-03-23 security@apache.org

Apache Path Traversal Commons Vfs Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:32 vuln.today

CVE Published

Mar 23, 2025 - 15:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

512 maven packages depend on org.apache.commons:commons-vfs2 (92 direct, 420 indirect)

Ecosystem-wide dependent count for version 2.10.0.

DescriptionCVE.org

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.

The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.

Users are recommended to upgrade to version 2.10.0, which fixes the issue.

AnalysisAI

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-23. Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue. Affected products include: Apache Commons Vfs. Version information: before 2.10.0..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Commons Vfs

View all

CVE-2025-30474 MEDIUM This Month

5.0 Mar 23

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. Rated medium severity (C

Same weakness CWE-23 – Relative Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2024-27199 HIGH POC

7.3

CVE-2025-34510 HIGH POC

8.8

CVE-2026-34926 MEDIUM POC

6.7

CVE-2024-24578 CRITICAL POC

9.8

CVE-2025-52207 CRITICAL POC

9.9

CVE-2023-6825 CRITICAL POC

9.9

CVE-2022-1373 HIGH POC

7.2

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

CVE-2025-27553 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Commons Vfs CVE-2025-27553

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Commons Vfs

Same weakness CWE-23 – Relative Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code