Apache Commons FileUpload vulnerabilities

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Apache Commons FileUpload before version 1.3.3 has a vulnerability that allows remote code execution through DiskFileItem file manipulation.

Apache Commons FileUpload before version 1.3.1 has a vulnerability that allows remote attackers to cause a denial of service via a crafted Content-Type header. This can lead to an infinite loop and high CPU consumption.

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.