JWt

JWt includes and depends on commons-fileupload 1.3.3 in its Maven POM file. This is marked as having known vulnerabilities CVE-2016-1000031, CVE-2023-24998. Both are to my knowledge not applicable to JWt. Still, Maven dependency analysis software marks JWt as vulnerable because of transitive dependencies with known vulnerabilities.

This library is only used for the check isMultipartContent(). This method checks whether the request is a POST where the Content-Type starts with multipart/.

Does this usage warrant the inclusion of the entire commons-fileupload? Can we either upgrade the dependency, or remove it by implementing this method ourselves?