#28684 DoS vulnerability in Apache Commons FileUpload (CVE-2025-48976)

Enhancement

Major

#28593

Baumselektions-Modell mit Teilbaum-Selektionslogik

#28695

Selektionsfilter für (Tree-)tables und -grids im Layout-Editor einstellen

#28704

Optimized access to table FLEX_DATA for some DBs

Detail

#28613

"DefaultFor" Konfigurationsoption im "advanceProcess"-Template für BPE

#28679

Dynamic labels for FormTableDefinition

#28705

Close Formlar dialogs on Cancel

#28712

Test can set whether warnings lead to failure

Nice to have

#28588

Option to mark tables in forms as non-selectable

Bugfix

Major

#28673

Vulnerability in commons-beanutils (CVE-2025-48734)

#28675

Opening Excel-Scripts in Script Recorder fails when starting from command line

#28676

Securing Kafka client configuration against SSRF and file reads (CVE-2025-27817)

#28684

DoS vulnerability in Apache Commons FileUpload (CVE-2025-48976)

#28692

ClassCastException in the ActiveTaskComponent

#28700

Security gap in workflow transitions - Unauthorized processing after task completion

#28739

TL script method filterPermission must not be evaluated at compile time

Detail

#28331

Incorrect update type creation in tUpdate leads to ignoring of hidden attribute changes

#28617

Bug: Post-Create-Actions fehlen bei Prozess-Start ohne Prüfung

#28640

Mandatory Multiline fields do not have a blue line

#28665

Calculated attributes are not updated when tables are changed

#28666

Fehlender DisplayContext nach BinaryDataSource-Conversion

#28667

Pipe closed Error when sending mail due to double rendering of content without EncodingAware interface

#28671

ExcelWriter methods are missing

#28686

REST routing: Shorter paths are prioritized over longer paths and cause incorrect route matching

#28690

Create in currency administration has wrong command group

#28698

Executability rule is checked on deleted object

#28706

Form tables exceed container width

#28707

Falsches Dirty-Handling im SelectTransitionDialog (BPE)

#28724

Selection filter must not be evaluated on deleted objects

#28726

Unique-Constraint-Violation bei mehrfacher Anwendung des MoveObjectsProcessor

Nice to have

#28458

Falsche Abfrage, ob Komponente Multi-Selektion unterstützt

Bugfix

Major

#28684

DoS vulnerability in Apache Commons FileUpload (CVE-2025-48976)

FileUpload SecurityIssue

There is a security vulnerability (CVE-2025-48976) in the currently used version of the Apache Commons FileUpload library, which allows attackers to trigger a denial of service (DoS) attack by deliberately placing multipart headers. The reason for this is the insufficient limitation of resources when parsing multipart headers.

The versions affected are:

1.x before 1.6

2.0.0-M1 to before 2.0.0-M4

The vulnerability will be fixed by upgrading to version 2.0.0-M4.

Note on the new version

As of version 2.0.0-M4, a new protective measure has been introduced by Apache: the configuration field partHeaderSizeMax, which limits the maximum size of individual multipart headers (default: 512 bytes). This means that overlong headers are discarded at an early stage, which prevents DoS attacks. If upload clients send particularly large headers (e.g. with extensive metadata), this value can be adjusted via the factory configuration if required.