CVE-2016-1000031

FAUCET Score

CVE-2016-1000031 is a critical remote code execution vulnerability affecting Apache Commons FileUpload versions prior to 1.3.3, specifically related to DiskFileItem file manipulation. This flaw carries a CVSSv3 score of 9.8 (Critical), indicating it can be exploited remotely with low attack complexity and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation (KEV listed as No) and no public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, suggesting awareness of its severe potential.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 1.3.2CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload::::::::

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

34.73%

Probability of exploitation in next 30 days

EPSS Percentile

98.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.3473 is in the 95th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

mavenpatch availablevia ghsa

Product: commons-fileupload:commons-fileuploadFixed in: 1.3.3

beegovendor investigatingvia llm_extracted

lexmarkvendor investigatingvia llm_extracted

libreofficevendor investigatingvia llm_extracted

postgresqlvendor investigatingvia llm_extracted

pythonvendor investigatingvia llm_extracted

Vendor Advisories (12)

mavenGHSA-7x9j-7223-rg5mcritical

Improper Access Control in commons-fileupload

Dec 21, 2018

beegollm-beego-d0559973177397c2CRITICAL

[R1] Novell NetIQ Sentinel Commons DiskFileItem RMI Java Deserialization Remote File Creation / Manipulation

Oct 17, 2016

postgresqlllm-postgresql-d802868286f443e7CRITICAL

[R1] Novell NetIQ Sentinel Commons DiskFileItem RMI Java Deserialization Remote File Creation / Manipulation

Oct 17, 2016

lexmarkllm-lexmark-a0adb6b848788fbcCRITICAL

[R1] Novell NetIQ Sentinel Commons DiskFileItem RMI Java Deserialization Remote File Creation / Manipulation

Oct 17, 2016

libreofficellm-libreoffice-a58b106aed8c2996CRITICAL

[R1] Novell NetIQ Sentinel Commons DiskFileItem RMI Java Deserialization Remote File Creation / Manipulation

Oct 17, 2016

beegollm-beego-1503c28495d270eaMEDIUM

[R4] Apache Wicket DiskFileItem Java Deserialization Remote File Manipulation

Aug 12, 2016

postgresqlllm-postgresql-044b1a67ecdcb374MEDIUM

[R4] Apache Wicket DiskFileItem Java Deserialization Remote File Manipulation

Aug 12, 2016

lexmarkllm-lexmark-4544ea6684591742MEDIUM

[R4] Apache Wicket DiskFileItem Java Deserialization Remote File Manipulation

Aug 12, 2016

libreofficellm-libreoffice-a1ecfbc9c81e2a39MEDIUM

[R4] Apache Wicket DiskFileItem Java Deserialization Remote File Manipulation

Aug 12, 2016

beegollm-beego-d38831a1a95d7ff1CRITICAL

[R3] Apache Commons FileUpload DiskFileItem File Manipulation Remote Code Execution (LOBSTER)

Apr 20, 2016

pythonllm-python-baac04e3c79b824eCRITICAL

[R3] Apache Commons FileUpload DiskFileItem File Manipulation Remote Code Execution (LOBSTER)

Apr 20, 2016

redhatCVE-2016-1000031Moderate

FileUpload: DiskFileItem file manipulation

Apr 20, 2016

References

lists.opensuse.org / opensuse-security-announce/2019-05/msg00036.html

issues.apache.org / jira/browse/FILEUPLOAD-279

Vendor Advisory

issues.apache.org / jira/browse/WW-4812

lists.apache.org / thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

lists.apache.org / thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E

security.netapp.com / advisory/ntap-20190212-0001

oracle.com / security-alerts/cpuapr2020.html

oracle.com / security-alerts/cpujan2020.html

oracle.com / security-alerts/cpujan2021.html

oracle.com / security-alerts/cpujul2020.html

oracle.com / security-alerts/cpujul2022.html

oracle.com / security-alerts/cpuoct2020.html

oracle.com / security-alerts/cpuoct2021.html

oracle.com / technetwork/security-advisory/cpuapr2019-5072813.html

oracle.com / technetwork/security-advisory/cpujan2019-5072801.html

oracle.com / technetwork/security-advisory/cpujul2019-5072835.html

oracle.com / technetwork/security-advisory/cpuoct2016-2881722.html

oracle.com / technetwork/security-advisory/cpuoct2019-5072832.html

tenable.com / security/research/tra-2016-12

Third Party Advisory

tenable.com / security/research/tra-2016-23

Third Party Advisory

tenable.com / security/research/tra-2016-30

Third Party Advisory

oracle.com / technetwork/security-advisory/cpuoct2018-4428296.html

securityfocus.com / bid/93604

Third Party AdvisoryVDB Entry

zerodayinitiative.com / advisories/ZDI-16-570

Third Party AdvisoryVDB Entry