CVE-2021-29425

CVE-2021-29425 is a limited path traversal vulnerability in Apache Commons IO versions prior to 2.7, affecting products like Apache, Debian, NetApp, and Oracle. An attacker could exploit this by providing a specially crafted input string to FileNameUtils.normalize, potentially gaining limited access to files in a parent directory. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with high complexity, resulting in low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.