StackRadarChart IndexLive demo

CVE-2021-29425

Medium

Advisory

Published 26 Apr 2021In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.8; base score, highest
EPSS: 0.102; 95th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 185; of 17,781 indexed, latest versions
Container images: 190; deployed by those charts
Fix available: 1 of 1; affected package

Path Traversal and Improper Input Validation in Apache Commons IO

Carried by container images the latest versions of 185 of 17,781 indexed charts deploy, on 190 images.

Affected package	Affected versions	Fixed in	Images
commons-iomaven	1.3.1, 1.3.2, 1.4, 2.0+6 more	2.7	190

OSV records: GHSA-gwrp-pvrq-jmwv

Charts affected

185 by stars

Chart

Latest

Affected images

Radar Score

smsf-momtopenshift

1 of 1 See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	commons-io@2.1	2.7

Open the chart page →

13,568

smsf-registrationopenshift

1 of 1 See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
gurolakman/smsf-registration :1.0.4	b22e746edd5d	commons-io@2.1	2.7

Open the chart page →

13,551

openwhiskopenwhisk

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
library/zookeeper :3.4	3882d9493d38	commons-io@2.6	2.7
openwhisk/invoker :1.0.0	f5831ec85525	commons-io@2.6	2.7

Open the chart page →

36,215

p4p4

1 of 7 See more

27,537

Practica_4_helmpr04helm

1 of 7 See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
pcarrascoponce/planner :v1.0	981fc482442c	commons-io@2.6	2.7

Open the chart page →

27,558

hive-metastorepresto-loadbalancer

1 of 1 See more

hive-metastore presto-loadbalancer 0.2.3

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
datappeal/hive-metastore :latest	e38c085a3567	commons-io@2.5	2.7

Open the chart page →

9,606

radar-integrationradar-base

1 of 1 See more

radar-integration radar-base 0.9.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
radarbase/radar-redcapintegration :1.0.6	fcd973d4796d	commons-io@2.5	2.7

Open the chart page →

2,855

stackrox-chartredhat-cop

1 of 1 See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	commons-io@2.5	2.7

Open the chart page →

29,227

reportportalreportportal

2 of 8 See more

reportportal reportportal 5.7.2

2 of the 8 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
reportportal/service-api :5.7.2	9df41f8fb320	commons-io@2.6	2.7
reportportal/service-authorization :5.7.0	9e73114dbd15	commons-io@2.6	2.7

Open the chart page →

25,737

bastillion-upstreamrock8s

1 of 1 See more

bastillion-upstream rock8s 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
iamdorsah/bastillion :v0.1	db83a0254d81	commons-io@2.2	2.7

Open the chart page →

3,051

shenyushenyu-helm-chart-test

1 of 2 See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	commons-io@2.4	2.7

Open the chart page →

12,513

digdagskyoo2003

1 of 4 See more

digdag skyoo2003 0.5.2

1 of the 4 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
ghcr.io/skyoo2003/digdag :0.0.1	821fd6a6f2cd	commons-io@2.5	2.7

Open the chart page →

6,949

archivaslamdev

1 of 2 See more

archiva slamdev 0.0.7

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
xetusoss/archiva :v2.2.5	88f25242b9ee	commons-io@2.4	2.7

Open the chart page →

6,907

hetzner-iroboslamdev

1 of 1 See more

hetzner-irobo slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
slamdev/hetzner-irobo :0.0.1	3ca20c184c55	commons-io@2.6	2.7

Open the chart page →

3,754

atlassian-confluencesomeblackmagic

1 of 1 See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
atlassian/confluence-server :7.10.0	3b9222ab32ef	commons-io@2.6	2.7

Open the chart page →

13,605

atlassian-jirasomeblackmagic

1 of 1 See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
atlassian/jira-software :8.14.0	37bc46cbec1a	commons-io@2.6	2.7

Open the chart page →

13,079

newrelic-private-minionsstarcher

1 of 1 See more

newrelic-private-minion sstarcher 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
quay.io/newrelic/synthetics-minion :2.2.21	98c26e1b8f70	commons-io@2.6	2.7

Open the chart page →

3,164

allurestakater

1 of 1 See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	commons-io@2.6	2.7

Open the chart page →

28,165

nordmart-reviewstakater

1 of 3 See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	commons-io@2.6	2.7

Open the chart page →

11,554

nordmart-review-instancestakater

1 of 3 See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	commons-io@2.6	2.7

Open the chart page →

11,554

sonarqubestakater

1 of 2 See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
library/sonarqube :6.7.6-community	0ae5169e3d0f	commons-io@2.4	2.7

Open the chart page →

11,841

unifistartechnica

1 of 2 See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
jacobalberty/unifi :v7.1.66	4a3616625dda	commons-io@2.6	2.7

Open the chart page →

14,493

trinostatcan

1 of 2 See more

13,767

streamastreama

1 of 2 See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
just1not2/streama :1.10.4	8a2305192dec	commons-io@2.4	2.7

Open the chart page →

8,554

rundecksvtech-public-helm-charts

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	commons-io@2.6	2.7

Open the chart page →

18,756

shenyutest-helm

1 of 2 See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	commons-io@2.4	2.7

Open the chart page →

12,513

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	commons-io@2.6	2.7

Open the chart page →

12,455

ubooquityvhdirk

1 of 1 See more

ubooquity vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	commons-io@2.5	2.7

Open the chart page →

4,303

queryservicewbstack

1 of 1 See more

queryservice wbstack 0.2.1

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice :0.3.6_0.6	b83b5b81d4b6	commons-io@2.4	2.7

Open the chart page →

4,649

queryservice-updaterwbstack

1 of 1 See more

queryservice-updater wbstack 0.3.0

1 of the 1 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-updater :0.3.84_3.9	7525a57ac3f1	commons-io@2.4	2.7

Open the chart page →

3,176

sonarqubewebencryptor

1 of 3 See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
library/sonarqube :8.2-community	a246bc64207e	commons-io@2.6	2.7

Open the chart page →

5,460

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	commons-io@2.5	2.7

Open the chart page →

28,605

opendistro-eswitcom-gmbh

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	commons-io@2.3	2.7

Open the chart page →

5,806

workshop-pipelinesworkshop-pipelines

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	commons-io@2.6	2.7

Open the chart page →

11,577

is-pattern-1wso2is-pattern1

1 of 2 See more

is-pattern-1 wso2is-pattern1 5.11.0

1 of the 2 container images this version deploys carry CVE-2021-29425.

Container image	Digest	Package	Fixed in
massimolauri/wso2is :5.11.0-centos	e08abf0ce767	commons-io@2.0	2.7

Open the chart page →

6,213

Container images carrying it

190 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
slamdev/apache-hive :2.3.9-2.10.1	b4b029c9b15f	commons-io@2.4	2.7	1
slamdev/hetzner-irobo :0.0.1	3ca20c184c55	commons-io@2.6	2.7	1
snappydatainc/spark-shuffle :v2.2.0-kubernetes-0.5.1	fd4b2070466f	commons-io@2.4	2.7	1
sslhep/hive-metastore :3.1.3	9e80af083079	commons-io@2.5	2.7	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	commons-io@2.6	2.7	1
thehiveproject/cortex :3.1.7	f4bc64fb8844	commons-io@2.5	2.7	1
tock/bot_api :25.10.7	dd5d5c70e333	commons-io@2.4	2.7	1
tock/kotlin_compiler :25.10.7	c9c0fb40089a	commons-io@2.4	2.7	1
trinodb/trino :405	ee80ab5eeab2	commons-io@2.5	2.7	1
viniciusfcf/gitops-quarkus-app-jvm :latest	bba8ee1b5cd5	commons-io@2.6	2.7	1
voltha/voltha-onos :5.1.8	e038acb950d3	commons-io@2.6	2.7	1
vromero/activemq-artemis :2.16.0	408d6a46b153	commons-io@2.2	2.7	1
wavefronthq/proxy :9.2	d1064d28f6eb	commons-io@2.5	2.7	1
wistefan/mvf :latest	e0887302b2d8	commons-io@2.6	2.7	1
xetusoss/archiva :v2.2.5	88f25242b9ee	commons-io@2.4	2.7	1
zammad/zammad-docker-compose :zammad-elasticsearch-4.1.0-31	8274d75a51fc	commons-io@2.6	2.7	1
zenko/zenko-cosbench :0.0.6	386a1f48ec0e	commons-io@1.4	2.7	1
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	commons-io@2.6	2.7	1
ghcr.io/curium-rocks/mitre-siphon :main	503c00321502	commons-io@2.4	2.7	1
ghcr.io/data-fair/elasticsearch :7.17.1	aa45adaf59a7	commons-io@2.6	2.7	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	commons-io@2.6	2.7	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	commons-io@2.5	2.7	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	commons-io@2.6	2.7	1
ghcr.io/linuxserver/booksonic-air :version-v2009.1.0	baa4fa9549dc	commons-io@2.6	2.7	1
ghcr.io/openccu/openccu :3.89.8.20260719	b2de2ff6e8e0	commons-io@2.4	2.7	1
ghcr.io/skyoo2003/digdag :0.0.1	821fd6a6f2cd	commons-io@2.5	2.7	1
ghcr.io/wbstack/queryservice :0.3.6_0.6	b83b5b81d4b6	commons-io@2.4	2.7	1
ghcr.io/wbstack/queryservice-updater :0.3.84_3.9	7525a57ac3f1	commons-io@2.4	2.7	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.59.3_local	8cdcb7e83f9f	commons-io@2.6	2.7	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	commons-io@2.6	2.7	1
quay.io/fiware/apollo :0.0.10	55330b1b60c1	commons-io@2.6	2.7	1
quay.io/fiware/canis-major :1.5.15	bb40472e4ff5	commons-io@2.6	2.7	1
quay.io/fiware/endpoint-configuration-service :0.4.3	0dc38a87b844	commons-io@2.6	2.7	1
quay.io/fiware/trusted-issuers-registry :0.11.1	a8a9ec461034	commons-io@2.6	2.7	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	commons-io@2.5	2.7	1
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	commons-io@2.6	2.7	1
quay.io/newrelic/synthetics-minion :2.2.21	98c26e1b8f70	commons-io@2.6	2.7	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	commons-io@2.5	2.7	1
quay.io/snowdrop/spring-boot-rest-http-example :2.7	b1a054613715	commons-io@2.5	2.7	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	commons-io@2.6	2.7	1