GHSA-3936-3gx6-49c4

Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-30474

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.commons:commons-vfs2	< 2.10.0	2.10.0

Details

As written in the advisory (Markdown source, shown as plain text).

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-30474 advisory
https://github.com/apache/commons-vfs package
https://issues.apache.org/jira/browse/VFS-169 web
https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4 web
http://www.openwall.com/lists/oss-security/2025/03/23/2 web