The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| commons-fileupload:commons-fileupload(Maven) | 1.0 | 1.2.2 | N/A |
CVSS Metrics
