Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Vulnerability

Description

The resolveFile method in Apache Commons VFS's FileObject API accepts a scope parameter. When NameScope.DESCENDENT is specified, the API promises to throw an exception if the resolved file is not a descendant of the base file. However, versions before 2.10.0 fail to correctly handle URL-encoded path traversal sequences. For example, a path containing %2E%2E/bar.txt (where %2E%2E decodes to ..) bypasses the descendant check and returns a file object outside the base directory without throwing an exception [1][2].

Exploitation

Conditions

An attacker can exploit this vulnerability by supplying a crafted path to an application that uses Apache Commons VFS and calls resolveFile with NameScope.DESCENDENT. No special authentication or network position is required if the application exposes file resolution functionality to untrusted input. The attacker simply provides a path containing encoded .. sequences to traverse to parent directories [1][2].

Impact

Successful exploitation allows an attacker to read or write files outside the intended base directory, depending on how the application uses the returned FileObject. This could lead to information disclosure or unauthorized file operations. The Apache security team has rated this issue as low severity [2].

Mitigation

Users should upgrade to Apache Commons VFS version 2.10.0, which corrects the path validation logic [1][3]. No workaround is provided for earlier versions. The vulnerability was discovered by Arnout Engelen [2].