StackRadar

CVE-2025-27553

High

Advisory

Published 23 Mar 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
17
of 17,781 indexed, latest versions
Container images
16
deployed by those charts
Fix available
1 of 1
affected package

Apache Commons VFS Has Relative Path Traversal Vulnerability

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 16 images.

Affected packageAffected versionsFixed inImages
commons-vfs2maven2.0, 2.1, 2.2, 2.3+2 more2.10.016
OSV records
GHSA-9q4x-fr4m-jp86

Charts affected

17 by stars
ChartLatestAffected imagesRadar Score
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
commons-vfs2@2.1
2.10.0

Open the chart page →

7,166
hivedmwm-bigdataVerified publisher0.1.62 of 5See more

hive dmwm-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
commons-vfs2@2.0
2.10.0
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
commons-vfs2@2.0
2.10.0

Open the chart page →

20,837
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
commons-vfs2@2.1
2.10.0

Open the chart page →

7,335
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
commons-vfs2@2.0
2.10.0

Open the chart page →

107,811
hive-metastoreslamdev0.0.51 of 2See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
commons-vfs2@2.1
2.10.0

Open the chart page →

8,198
geoserver-cloudcamptocamp20.0.52 of 11See more

geoserver-cloud camptocamp2 0.0.5

2 of the 11 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
commons-vfs2@2.0
2.10.0
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
commons-vfs2@2.0
2.10.0

Open the chart page →

84,444
geoserverCloudcamptocamp20.0.62 of 11See more

geoserverCloud camptocamp2 0.0.6

2 of the 11 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
commons-vfs2@2.0
2.10.0
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
commons-vfs2@2.0
2.10.0

Open the chart page →

84,444
hive-metastoredmwm-bigdataVerified publisher0.1.31 of 2See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
commons-vfs2@2.0
2.10.0

Open the chart page →

6,882
gridgaingridgainOfficialVerified publisher1.0.61 of 1See more

gridgain gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
gridgain/community:8.9.11d32d182a0e6a
commons-vfs2@2.7.0
2.10.0

Open the chart page →

4,679
geoservercamptocamp20.0.32 of 12See more

geoserver camptocamp2 0.0.3

2 of the 12 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
commons-vfs2@2.0
2.10.0
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
commons-vfs2@2.0
2.10.0

Open the chart page →

88,335
prestocloudnativeapp0.1.11 of 1See more

presto cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
bivas/presto:0.19605545994f806
commons-vfs2@2.1
2.10.0

Open the chart page →

7,226
accumulogaffer2.2.11 of 4See more

accumulo gaffer 2.2.1

1 of the 4 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
gchq/accumulo:2.0.1c460bb587d6d
commons-vfs2@2.3
2.10.0

Open the chart page →

16,892
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
commons-vfs2@2.2
2.10.0

Open the chart page →

18,230
hivegradiant-bigdataVerified publisher0.1.62 of 5See more

hive gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
commons-vfs2@2.0
2.10.0
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
commons-vfs2@2.0
2.10.0

Open the chart page →

20,837
hive-metastoregradiant-bigdataVerified publisher0.1.31 of 2See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
commons-vfs2@2.0
2.10.0

Open the chart page →

6,882
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
commons-vfs2@2.9.0
2.10.0

Open the chart page →

5,826
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2025-27553.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
commons-vfs2@2.2
2.10.0

Open the chart page →

13,767

Container images carrying it

16 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
bde2020/hive:2.3.2-postgresql-metastore620267768985
commons-vfs2@2.0
2.10.0
4
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
commons-vfs2@2.0
2.10.0
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
commons-vfs2@2.0
2.10.0
2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
commons-vfs2@2.0
2.10.0
2
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
commons-vfs2@2.1
2.10.0
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
commons-vfs2@2.2
2.10.0
1
bivas/presto:0.19605545994f806
commons-vfs2@2.1
2.10.0
1
gchq/accumulo:2.0.1c460bb587d6d
commons-vfs2@2.3
2.10.0
1
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
commons-vfs2@2.0
2.10.0
1
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
commons-vfs2@2.0
2.10.0
1
gridgain/community:8.9.11d32d182a0e6a
commons-vfs2@2.7.0
2.10.0
1
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
commons-vfs2@2.9.0
2.10.0
1
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
commons-vfs2@2.1
2.10.0
1
sslhep/hive-metastore:3.1.39e80af083079
commons-vfs2@2.1
2.10.0
1
trinodb/trino:405ee80ab5eeab2
commons-vfs2@2.2
2.10.0
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
commons-vfs2@2.0
2.10.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.