CVE-2016-1000031

Name of the Vulnerable Software and Affected Versions Apache Commons FileUpload versions prior to 1.3.3

Description The issue is related to the deserialization mechanism in the DiskFileItem class of the Apache Commons FileUpload library. It allows a remote attacker to execute arbitrary code or manipulate files in the target system using specially crafted data. The vulnerability can be exploited by sending a specially formed Java Object, enabling the attacker to write or copy files to arbitrary disk locations and execute arbitrary code.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DiskFileItem class until a patch is available.