StackRadar

CVE-2025-48976

High

Advisory

Published 16 Jun 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.626
99th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
86
of 17,781 indexed, latest versions
Container images
110
deployed by those charts
Fix available
2 of 2
affected packages

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Carried by container images the latest versions of 86 of 17,781 indexed charts deploy, on 110 images.

Affected packageAffected versionsFixed inImages
commons-fileuploadmaven1.2.1, 1.3, 1.3.1, 1.3.1-jenkins-1+4 more1.6.0103
commons-fileupload2-coremaven2.0.0-M1, 2.0.0-M22.0.0-M48
OSV records
GHSA-vv7r-c36w-3prj

Charts affected

86 by stars
ChartLatestAffected imagesRadar Score
metabasedeliveryheroVerified publisher0.14.41 of 1See more

metabase deliveryhero 0.14.4

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
commons-fileupload@1.4
1.6.0

Open the chart page →

2,572
puppetserverpuppetserver9.5.22 of 5See more

puppetserver puppetserver 9.5.2

2 of the 5 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
commons-fileupload@1.4
1.6.0
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
commons-fileupload@1.4
1.6.0

Open the chart page →

14,184
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
commons-fileupload@1.5
1.6.0

Open the chart page →

8,636
me-untethr-nostr-relaykronkltdVerified publisher0.1.41 of 1See more

me-untethr-nostr-relay kronkltd 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
duck1123/me.untethr.nostr-relay:0.2.1119fc5d4cbfb
commons-fileupload@1.4
1.6.0

Open the chart page →

2,072
oesopsmxVerified publisher4.0.324 of 25See more

oes opsmx 4.0.32

4 of the 25 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
commons-fileupload@1.5
1.6.0
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
commons-fileupload@1.5
1.6.0
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
commons-fileupload@1.5
1.6.0
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
commons-fileupload@1.5
1.6.0

Open the chart page →

107,811
vrijbrpvrijbrpVerified publisher0.1.51 of 5See more

vrijbrp vrijbrp 0.1.5

1 of the 5 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vrijbrp/balie-ws:developc6603cb829ea
commons-fileupload@1.4
1.6.0

Open the chart page →

8,811
geoserver-cloudcamptocamp20.0.55 of 11See more

geoserver-cloud camptocamp2 0.0.5

5 of the 11 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
commons-fileupload@1.4
1.6.0
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
commons-fileupload@1.3.3
1.6.0

Open the chart page →

84,444
geoserverCloudcamptocamp20.0.65 of 11See more

geoserverCloud camptocamp2 0.0.6

5 of the 11 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
commons-fileupload@1.4
1.6.0
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
commons-fileupload@1.3.3
1.6.0

Open the chart page →

84,444
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
commons-fileupload@1.3.2
1.6.0

Open the chart page →

7,891
wiremockdeliveryheroVerified publisher1.4.61 of 2See more

wiremock deliveryhero 1.4.6

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.26.03be08a386092
commons-fileupload@1.4
1.6.0

Open the chart page →

2,140
spinnakerdwardu-helm-charts2.2.61 of 2See more

spinnaker dwardu-helm-charts 2.2.6

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
commons-fileupload@1.4
1.6.0

Open the chart page →

8,752
enavenav-service-architectureVerified publisher0.0.75 of 10See more

enav enav-service-architecture 0.0.7

5 of the 10 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
commons-fileupload@1.5
1.6.0
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
commons-fileupload@1.5
1.6.0
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
commons-fileupload@1.5
1.6.0
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
commons-fileupload@1.5
1.6.0
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
commons-fileupload@1.5
1.6.0

Open the chart page →

15,860
omada-controllergeek-cookbookVerified publisher4.4.21 of 1See more

omada-controller geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
commons-fileupload@1.3.3
1.6.0

Open the chart page →

11,553
stormgresearch1.2.01 of 3See more

storm gresearch 1.2.0

1 of the 3 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
library/storm:2.4.0bd5d420506d6
commons-fileupload@1.3.3
1.6.0

Open the chart page →

6,165
jenkinsjkimVerified publisher5.5.141 of 2See more

jenkins jkim 5.5.14

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
jenkins/jenkins:2.462.2-jdk1795313257a8cd
commons-fileupload2-core@2.0.0-M2
2.0.0-M4

Open the chart page →

7,387
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
commons-fileupload@1.5
1.6.0

Open the chart page →

2,221
jenkinstestchart0.1.91 of 2See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
commons-fileupload@1.5
1.6.0

Open the chart page →

9,102
jenkinstest-jenkins9.1.01 of 2See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
commons-fileupload@1.5
1.6.0

Open the chart page →

9,102
accountaccount-serviceVerified publisher0.4.21 of 1See more

account account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vitalii1992/account-service:latest0e694d94551d
commons-fileupload@1.4
1.6.0

Open the chart page →

2,168
analyticsaccount-serviceVerified publisher0.4.21 of 1See more

analytics account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vitalii1992/analytics-service:latest8e798836ecea
commons-fileupload@1.4
1.6.0

Open the chart page →

2,326
gatewayaccount-serviceVerified publisher0.4.21 of 1See more

gateway account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vitalii1992/api-gateway-service:latestaabe6ac39356
commons-fileupload@1.4
1.6.0

Open the chart page →

2,853
orderaccount-serviceVerified publisher0.4.21 of 1See more

order account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vitalii1992/order-service:latest07c4a8833ce4
commons-fileupload@1.4
1.6.0

Open the chart page →

2,221
quotes-provideraccount-serviceVerified publisher0.4.21 of 1See more

quotes-provider account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
vitalii1992/quotes-provider-service:latest44d2d6e00ab3
commons-fileupload@1.4
1.6.0

Open the chart page →

2,205
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
commons-fileupload@1.4
1.6.0

Open the chart page →

9,321
akto-mini-testing-kafkaakto1.42.11 of 5See more

akto-mini-testing-kafka akto 1.42.1

1 of the 5 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:improve-testing-performance8e9d15ed71c7
commons-fileupload@1.5
1.6.0

Open the chart page →

6,397
akto-protectionakto0.1.01 of 4See more

akto-protection akto 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
aktosecurity/akto-api-protection:localbcd7382c9c1b
commons-fileupload@1.5
1.6.0

Open the chart page →

11,285
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
aktosecurity/source-code-analyser:a-1703-merge274042ed7a53
commons-fileupload@1.5
1.6.0

Open the chart page →

4,880
akto-testing-db-layerakto1.42.161 of 2See more

akto-testing-db-layer akto 1.42.16

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.59.3_local8cdcb7e83f9f
commons-fileupload@1.4
1.6.0

Open the chart page →

5,489
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
commons-fileupload@1.4
1.6.0

Open the chart page →

3,442
omada-controllerandrelote-k8sVerified publisher4.5.01 of 1See more

omada-controller andrelote-k8s 4.5.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
commons-fileupload@1.3.3
1.6.0

Open the chart page →

11,553
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
commons-fileupload@1.5
1.6.0

Open the chart page →

16,975
sdn-controllerassist-iot-sdn-controller2.4.01 of 1See more

sdn-controller assist-iot-sdn-controller 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
assistiot/sdn_controller:2.4.0ea254b6d8a31
commons-fileupload@1.4
1.6.0

Open the chart page →

7,936
dashboard-pui9assist-iot-tactile-dashboard0.2.01 of 3See more

dashboard-pui9 assist-iot-tactile-dashboard 0.2.0

1 of the 3 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
commons-fileupload@1.4
1.6.0

Open the chart page →

4,145
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
commons-fileupload2-core@2.0.0-M1
2.0.0-M4

Open the chart page →

1,816
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
jenkins/jenkins:2.440.3-jdk17de4fea113221
commons-fileupload@1.5
1.6.0

Open the chart page →

8,323
geoservercamptocamp20.0.35 of 12See more

geoserver camptocamp2 0.0.3

5 of the 12 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
commons-fileupload@1.4
1.6.0
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
commons-fileupload@1.3.3
1.6.0
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
commons-fileupload@1.3.3
1.6.0

Open the chart page →

88,335
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
commons-fileupload@1.4
1.6.0

Open the chart page →

5,886
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
commons-fileupload@1.5
commons-fileupload2-core@2.0.0-M1
1.6.0
2.0.0-M4

Open the chart page →

1,215
cosbenchcloudnativeapp1.0.11 of 1See more

cosbench cloudnativeapp 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
zenko/zenko-cosbench:0.0.6386a1f48ec0e
commons-fileupload@1.2.1
1.6.0

Open the chart page →

4,906
gocdcloudnativeapp1.9.21 of 2See more

gocd cloudnativeapp 1.9.2

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
gocd/gocd-server:v19.3.02da45cb09d57
commons-fileupload@1.4
1.6.0

Open the chart page →

9,144
metabasecloudnativeapp0.5.01 of 1See more

metabase cloudnativeapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
metabase/metabase:v0.31.2ffb2dccacefc
commons-fileupload@1.3.3
1.6.0

Open the chart page →

4,601
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
commons-fileupload@1.3.3
1.6.0

Open the chart page →

23,665
dara-chartsdara-charts0.1.01 of 2See more

dara-charts dara-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
razzy10/product-service:latest702e411956db
commons-fileupload@1.5
1.6.0

Open the chart page →

3,547
deployhubdeployhubVerified publisher10.0.4151 of 11See more

deployhub deployhub 10.0.415

1 of the 11 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
commons-fileupload@1.5
1.6.0

Open the chart page →

11,160
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
commons-fileupload@1.3.3
1.6.0

Open the chart page →

19,802
entrypoint-balancereclipse-aeriosVerified publisher1.3.01 of 1See more

entrypoint-balancer eclipse-aerios 1.3.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
commons-fileupload@1.5
1.6.0

Open the chart page →

2,512
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
commons-fileupload@1.5
1.6.0

Open the chart page →

7,792
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
commons-fileupload@1.4
1.6.0

Open the chart page →

18,230
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
commons-fileupload@1.4
1.6.0

Open the chart page →

19,215
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2025-48976.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
commons-fileupload@1.3.2
1.6.0

Open the chart page →

27,949

Container images carrying it

110 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
commons-fileupload@1.4
1.6.0
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
commons-fileupload@1.4
1.6.0
1
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
commons-fileupload@1.3.3
1.6.0
1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:improve-testing-performance8e9d15ed71c7
commons-fileupload@1.5
1.6.0
1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.59.3_local8cdcb7e83f9f
commons-fileupload@1.4
1.6.0
1
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
commons-fileupload@1.5
1.6.0
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
commons-fileupload@1.5
1.6.0
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
commons-fileupload@1.5
1.6.0
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
commons-fileupload@1.5
1.6.0
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
commons-fileupload@1.5
1.6.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.