diff --git a/javaee-legacy-app/pom.xml b/javaee-legacy-app/pom.xml
index 4faafc9..45da636 100644
--- a/javaee-legacy-app/pom.xml
+++ b/javaee-legacy-app/pom.xml
@@ -79,7 +79,7 @@
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.4</version>
+            <version>2.14.0</version>
         </dependency>
 
         <!-- Jackson Databind 2.9.8 - CVE-2019-12384, CVE-2019-14540, etc. (deserialization) -->