CVE-2013-0248: Low severity Apache Commons Fileupload vulnerability
Published Mar 15, 2013
·Updated
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Affected Software
7 affected components
Apache Commons Fileupload=1.0
Apache Commons Fileupload=1.1
Apache Commons Fileupload=1.1.1
Apache Commons Fileupload=1.2
Apache Commons Fileupload=1.2.1
Apache Commons Fileupload=1.2.2
IBM InfoSphere Data Architect<=9.2.1
Event History
Mar 15, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-0248?
CVE-2013-0248 has a medium severity level due to its potential exploitation via symlink attacks.
2
How do I fix CVE-2013-0248?
To fix CVE-2013-0248, configure the tempdir to a secure, non-writable directory instead of the default /tmp.
3
Which versions of Apache Commons FileUpload are affected by CVE-2013-0248?
CVE-2013-0248 affects versions 1.0 through 1.2.2 of Apache Commons FileUpload.
4
What kind of attack does CVE-2013-0248 enable?
CVE-2013-0248 enables local users to perform a symlink attack, allowing them to overwrite arbitrary files.
5
Is CVE-2013-0248 a remote or local vulnerability?
CVE-2013-0248 is a local vulnerability, as it requires local system access to exploit.