AEM Forms 6.5: Apache Commons FileUpload CVE-2025-48976 vulnerability and legacy JAR presence
This article addresses concerns about security scans reporting an older commons-fileupload JAR file in AEM Forms 6.5 environments and clarifies why this doesn’t mean the environment is vulnerable to CVE-2025-48976.
Description description
Environment
Adobe Experience Manager (AEM) Forms 6.5 (JEE, Standalone, DEV/PROD)
Symptoms
A security scan reports the presence of a vulnerable version of Apache Commons FileUpload (commons-fileupload-1.3.3.jar) in the application directory (For example: under /resources/install/5/).
The concern is related to CVE-2025-48976, a Denial of Service (DoS) vulnerability affecting Apache Commons FileUpload versions prior to 1.6 and 2.0.0-M4. The expectation is that a Service Pack update would resolve the issue, but the older JAR file remains present on disk after the update. No runtime errors or exploit attempts have been observed. The issue is identified by the presence of the file, not by any observed behavior.
Cause
The Service Pack updates the runtime OSGi bundle to a secure version, but doesn’t remove legacy JAR files from the filesystem. The presence of commons-fileupload-1.3.3.jar on disk doesn’t indicate an active vulnerability if the runtime bundle is updated.
Resolution resolution
Follow the steps below to resolve the issue:
- Log in to the AEM Forms environment.
- Access the OSGi Bundles page (typically at
/system/console/bundles). - Search for the
commons-fileuploadbundle. - Confirm that the version in use is 1.6.0 or higher.
- If the runtime bundle is updated, no further action is required, even if older JAR files remain on disk.
- If the older version is still active at runtime, escalate for remediation.
Verifying the runtime bundle version ensures protection against CVE-2025-48976.