Skip to content

[Security] Bump commons-io from 2.6 to 2.7

dependabot requested to merge dependabot-maven-commons-io-commons-io-2.7 into main

Bumps commons-io from 2.6 to 2.7. This update includes a security fix.

Vulnerabilities fixed

Path Traversal and Improper Input Validation in Apache Commons IO In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Patched versions: 2.7 Affected versions: < 2.7


Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports