[WW-5131] Upgrade commons-io to version 2.9

• Type: Dependency
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 6.0.0
• Assignee: Unassigned
• Reporter: Lukasz Lenart
• Created: 31/May/21 05:03
• Updated: 14/Jun/22 09:47
• Resolved: 31/May/21 05:40

Description

Apache Commons IO 2.6 has a known vulnerability CVE-2021-29425 - yet upgrade requires to use Java 8 which can be only done in Struts 2.6. 

Users os Struts 2.5.x should upgrade commons-io manually when running on Java 8.