Skip to content
Fencer Intel
high 7.5

CVE-2013-2186 in the critical feed json

Arbitrary file write in Apache Commons Fileupload

published 2013-10-28 13 y ago modified 2026-06-16 4 mo ago also GHSA-qx6h-9567-5fqw , EUVD-2022-5056

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.7%
EPSS 12.7% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Patch / fix

  • maven commons-fileupload:commons-fileupload 1.3.1
  • libcommons-fileupload-java Debian 14, Debian 13, Debian 12 1.3-2.1

debian advisories DEBIAN-CVE-2013-2186

  • jenkins openshift 3.1 1.625.3-2.el7aos
  • heapster openshift 3.1 0.18.2-3.gitaf4752e.el7aos
  • nodejs-rc openshift 3.1 1.1.2-1.el7aos
  • nodejs-got openshift 3.1 5.2.1-1.el7aos
  • nodejs-ini openshift 3.1 1.1.0-6.el7aos
  • nodejs-from openshift 3.1 0.1.3-2.el7aos
  • nodejs-uuid openshift 3.1 2.0.1-1.el7aos
  • nss_wrapper openshift 3.1 1.0.3-1.el7

red hat advisories RHSA-2016:0070RHSA-2013:1428

  • apache-commons-fileupload openSUSE Tumbleweed 1.4-1.9

opensuse advisories openSUSE-SU-2024:10620-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2186 updated cvss 7.5

commons-fileupload: Arbitrary file upload via deserialization

  • Red Hat JBoss BRMS 5 commons-fileupload Red Hat JBoss Operations Network 3 commons-fileupload Red Hat JBoss Portal 4 commons-fileupload Red Hat JBoss Portal 5 commons-fileupload Red Hat JBoss Portal 6 commons-fileupload Red Hat JBoss SOA Platform 4 commons-fileupload
    +1 more products
    Red Hat JBoss SOA Platform 5 commons-fileupload
    affected: no fix available
  • Red Hat JBoss Enterprise BRMS Platform 5.3
    fixed: vendor fix RHSA-2013:1430
  • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server jakarta-commons-fileupload 1.1.1-7.7.ep5.el5 Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server jakarta-commons-fileupload 1.1.1-7.7.ep5.el6
    fixed: vendor fix RHSA-2013:1428
  • Red Hat JBoss Operations Network 3.1
    fixed: vendor fix RHSA-2013:1448
  • Red Hat JBoss Portal 4.3 Red Hat JBoss Portal 5.2 Red Hat JBoss Portal Platform 6.0
    fixed: vendor fix RHSA-2013:1430
  • Red Hat JBoss SOA Platform 4.3 Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2013:1442
  • Red Hat JBoss Web Server 1.0
    fixed: vendor fix RHSA-2013:1429
  • Red Hat OpenShift Enterprise 3.1 nss_wrapper 1.0.3-1.el7, openvswitch 2.4.0-1.el7, jenkins 1.625.3-2.el7aos, nodejs-rc 1.1.2-1.el7aos, nodejs-got 5.2.1-1.el7aos, nodejs-ini 1.1.0-6.el7aos, +127 more
    fixed: vendor fix RHSA-2016:0070

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

12.67% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven commons-fileupload:commons-fileupload
<1.3.1
1.3.1

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.