StackRadar

CVE-2021-29425

Medium

Advisory

Published 26 Apr 2021In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.102
95th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
185
of 17,781 indexed, latest versions
Container images
190
deployed by those charts
Fix available
1 of 1
affected package

Path Traversal and Improper Input Validation in Apache Commons IO

Carried by container images the latest versions of 185 of 17,781 indexed charts deploy, on 190 images.

Affected packageAffected versionsFixed inImages
commons-iomaven1.3.1, 1.3.2, 1.4, 2.0+6 more2.7190
OSV records
GHSA-gwrp-pvrq-jmwv

Charts affected

185 by stars
ChartLatestAffected imagesRadar Score
chart-app-vidapp-vid-chartVerified publisher0.0.71 of 2See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
commons-io@2.4
2.7

Open the chart page →

8,866
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
assistiot/automated_configuration:latest23f195a7a26a
commons-io@2.6
2.7

Open the chart page →

14,728
sdn-controllerassist-iot-sdn-controller2.4.01 of 1See more

sdn-controller assist-iot-sdn-controller 2.4.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
assistiot/sdn_controller:2.4.0ea254b6d8a31
commons-io@2.6
2.7

Open the chart page →

7,936
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
commons-io@2.3
2.7

Open the chart page →

5,806
rpc-routerchronicleVerified publisher0.2.91 of 1See more

rpc-router chronicle 0.2.9

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
drpcorg/dshackle:0.54.08858fae1859d
commons-io@2.6
2.7

Open the chart page →

6,447
cosbenchcloudnativeapp1.0.11 of 1See more

cosbench cloudnativeapp 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
zenko/zenko-cosbench:0.0.6386a1f48ec0e
commons-io@1.4
2.7

Open the chart page →

4,906
gocdcloudnativeapp1.9.22 of 2See more

gocd cloudnativeapp 1.9.2

2 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
gocd/gocd-agent-alpine-3.9:v19.3.053588bd3221f
commons-io@2.6
2.7
gocd/gocd-server:v19.3.02da45cb09d57
commons-io@2.6
2.7

Open the chart page →

9,144
metabasecloudnativeapp0.5.01 of 1See more

metabase cloudnativeapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
metabase/metabase:v0.31.2ffb2dccacefc
commons-io@2.5
2.7

Open the chart page →

4,601
neo4jcloudnativeapp1.0.01 of 1See more

neo4j cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
library/neo4j:3.4.5-enterprisea1ba477fa412
commons-io@2.6
2.7

Open the chart page →

2,837
prestocloudnativeapp0.1.11 of 1See more

presto cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
bivas/presto:0.19605545994f806
commons-io@2.4
2.7

Open the chart page →

7,226
riemanncloudnativeapp0.1.21 of 1See more

riemann cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
raykrueger/riemann:0.2.14c8baf3de57bb
commons-io@2.5
2.7

Open the chart page →

6,497
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
commons-io@2.2
2.7

Open the chart page →

23,665
spark-history-servercloudnativeapp1.0.01 of 3See more

spark-history-server cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
lightbend/spark-history-server:2.4.00bedf37f428a
commons-io@2.4
2.7

Open the chart page →

14,066
unificloudnativeapp0.4.21 of 1See more

unifi cloudnativeapp 0.4.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
jacobalberty/unifi:5.10.19c409924e2463
commons-io@2.6
2.7

Open the chart page →

22,442
pulsarcnieg1.0.82 of 2See more

pulsar cnieg 1.0.8

2 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
commons-io@2.5
2.7
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
commons-io@2.5
2.7

Open the chart page →

16,860
cp-helm-chartscp-helm-charts0.6.12 of 8See more

cp-helm-charts cp-helm-charts 0.6.1

2 of the 8 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
commons-io@2.5
2.7
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
commons-io@2.5
2.7

Open the chart page →

58,857
ldapd4nVerified publisher0.1.01 of 1See more

ldap d4n 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
dwimberger/ldap-ad-it:latest0c636e55eb82
commons-io@2.4
2.7

Open the chart page →

1,657
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
commons-io@2.5
2.7

Open the chart page →

8,245
spark-standalonedmwm-bigdataVerified publisher0.1.01 of 2See more

spark-standalone dmwm-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
commons-io@2.4
2.7

Open the chart page →

6,147
api-postsdniel0.9.11 of 1See more

api-posts dniel 0.9.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
dniel/api-posts:master45a667852f2a
commons-io@2.6
2.7

Open the chart page →

8,986
forwardauthdniel2.0.131 of 1See more

forwardauth dniel 2.0.13

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
dniel/forwardauth:latestf67129ea1c64
commons-io@2.6
2.7

Open the chart page →

4,592
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
library/neo4j:3.3.0d4eaa8484246
commons-io@2.4
2.7

Open the chart page →

11,174
spark-shuffleduyet0.2.01 of 1See more

spark-shuffle duyet 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
commons-io@2.4
2.7

Open the chart page →

5,639
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
commons-io@2.2
2.7

Open the chart page →

19,802
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
commons-io@2.6
2.7

Open the chart page →

2,237
mintakaeclipse-aeriosVerified publisher1.0.01 of 2See more

mintaka eclipse-aerios 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
fiware/mintaka:0.7.092a3c5cf43c0
commons-io@2.6
2.7

Open the chart page →

11,482
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
commons-io@2.6
2.7

Open the chart page →

27,537
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
commons-io@2.6
2.7

Open the chart page →

32,205
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
commons-io@2.6
2.7

Open the chart page →

27,537
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
molynx/planner:v1441c9f52f092
commons-io@2.6
2.7

Open the chart page →

28,482
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
arturisimo/planner:v1.0fff9de644941
commons-io@2.6
2.7

Open the chart page →

27,096
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
commons-io@2.6
2.7

Open the chart page →

27,537
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
lourdesmorente/new-planner:1.0.0608745878cdb
commons-io@2.6
2.7

Open the chart page →

27,721
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
commons-io@2.6
2.7

Open the chart page →

32,205
shenyuerdeng2.4.211 of 2See more

shenyu erdeng 2.4.21

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
commons-io@2.4
2.7

Open the chart page →

12,513
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
commons-io@2.6
2.7

Open the chart page →

2,021
apollofiware0.1.41 of 1See more

apollo fiware 0.1.4

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
quay.io/fiware/apollo:0.0.1055330b1b60c1
commons-io@2.6
2.7

Open the chart page →

6,936
canis-majorfiware0.2.31 of 1See more

canis-major fiware 0.2.3

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
commons-io@2.6
2.7

Open the chart page →

8,528
dss-validation-servicefiware0.0.191 of 1See more

dss-validation-service fiware 0.0.19

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
commons-io@2.6
2.7

Open the chart page →

4,536
endpoint-auth-servicefiware0.1.41 of 4See more

endpoint-auth-service fiware 0.1.4

1 of the 4 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
commons-io@2.6
2.7

Open the chart page →

11,835
mintakafiware0.4.71 of 1See more

mintaka fiware 0.4.7

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
fiware/mintaka:latestefc6793388cc
commons-io@2.6
2.7

Open the chart page →

7,019
trusted-issuers-registryfiware0.13.01 of 1See more

trusted-issuers-registry fiware 0.13.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
commons-io@2.6
2.7

Open the chart page →

7,087
base-depflofree-chartVerified publisher1.0.11 of 1See more

base-dep flofree-chart 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
flofree/base-project:2.1.16b6486c5f81e
commons-io@2.4
2.7

Open the chart page →

2,797
mod-copycatfolio-org0.1.31 of 1See more

mod-copycat folio-org 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
folioci/mod-copycat:latest1513fad2b799
commons-io@2.4
2.7

Open the chart page →

1,466
mod-marccatfolio-org0.1.301 of 1See more

mod-marccat folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
folioci/mod-marccat:latest1b57d690d568
commons-io@2.1
2.7

Open the chart page →

6,988
accumulogaffer2.2.11 of 4See more

accumulo gaffer 2.2.1

1 of the 4 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
gchq/accumulo:2.0.1c460bb587d6d
commons-io@2.6
2.7

Open the chart page →

16,892
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
commons-io@2.6
2.7

Open the chart page →

18,230
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
commons-io@2.6
2.7

Open the chart page →

19,215
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
commons-io@2.6
2.7

Open the chart page →

17,702
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
commons-io@2.4
2.7

Open the chart page →

27,949

Container images carrying it

190 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
commons-io@2.4
2.7
1
slamdev/hetzner-irobo:0.0.13ca20c184c55
commons-io@2.6
2.7
1
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
commons-io@2.4
2.7
1
sslhep/hive-metastore:3.1.39e80af083079
commons-io@2.5
2.7
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
commons-io@2.6
2.7
1
thehiveproject/cortex:3.1.7f4bc64fb8844
commons-io@2.5
2.7
1
tock/bot_api:25.10.7dd5d5c70e333
commons-io@2.4
2.7
1
tock/kotlin_compiler:25.10.7c9c0fb40089a
commons-io@2.4
2.7
1
trinodb/trino:405ee80ab5eeab2
commons-io@2.5
2.7
1
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
commons-io@2.6
2.7
1
voltha/voltha-onos:5.1.8e038acb950d3
commons-io@2.6
2.7
1
vromero/activemq-artemis:2.16.0408d6a46b153
commons-io@2.2
2.7
1
wavefronthq/proxy:9.2d1064d28f6eb
commons-io@2.5
2.7
1
wistefan/mvf:lateste0887302b2d8
commons-io@2.6
2.7
1
xetusoss/archiva:v2.2.588f25242b9ee
commons-io@2.4
2.7
1
zammad/zammad-docker-compose:zammad-elasticsearch-4.1.0-318274d75a51fc
commons-io@2.6
2.7
1
zenko/zenko-cosbench:0.0.6386a1f48ec0e
commons-io@1.4
2.7
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
commons-io@2.6
2.7
1
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
commons-io@2.4
2.7
1
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
commons-io@2.6
2.7
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
commons-io@2.6
2.7
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
commons-io@2.5
2.7
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
commons-io@2.6
2.7
1
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
commons-io@2.6
2.7
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
commons-io@2.4
2.7
1
ghcr.io/skyoo2003/digdag:0.0.1821fd6a6f2cd
commons-io@2.5
2.7
1
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
commons-io@2.4
2.7
1
ghcr.io/wbstack/queryservice-updater:0.3.84_3.97525a57ac3f1
commons-io@2.4
2.7
1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.59.3_local8cdcb7e83f9f
commons-io@2.6
2.7
1
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
commons-io@2.6
2.7
1
quay.io/fiware/apollo:0.0.1055330b1b60c1
commons-io@2.6
2.7
1
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
commons-io@2.6
2.7
1
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
commons-io@2.6
2.7
1
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
commons-io@2.6
2.7
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
commons-io@2.5
2.7
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
commons-io@2.6
2.7
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
commons-io@2.6
2.7
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
commons-io@2.5
2.7
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
commons-io@2.5
2.7
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
commons-io@2.6
2.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.