diff --git a/apache-commons-fileupload.spec b/apache-commons-fileupload.spec
index 9303ca4f778487d58ed682f46779498c552e3442..d24c68b19542aa4995798c723623e481eb4f394e 100644
--- a/apache-commons-fileupload.spec
+++ b/apache-commons-fileupload.spec
@@ -1,9 +1,9 @@
 %bcond_without  portlet
 Name:                apache-commons-fileupload
-Version:             1.5
+Version:             1.6.0
 Release:             1
 Summary:             API to work with HTML file upload
-License:             ASL 2.0
+License:             Apache-2.0
 URL:                 http://commons.apache.org/fileupload/
 BuildArch:           noarch
 Source0:             http://archive.apache.org/dist/commons/fileupload/source/commons-fileupload-%{version}-src.tar.gz
@@ -57,6 +57,9 @@ rm -r src/main/java/org/apache/commons/fileupload/portlet
 %license LICENSE.txt NOTICE.txt
 
 %changelog
+* Tue Jun 24 2025 wangkai <13474090681@163.com> - 1.6.0-1
+- Update to 1.6.0 for fix CVE-2025-48976
+
 * Tue Apr 16 2024 Ge Wang <wang__ge@126.com> - 1.5-1
 - Update to version 1.5
 
diff --git a/commons-fileupload-1.5-src.tar.gz b/commons-fileupload-1.5-src.tar.gz
deleted file mode 100644
index dc4d35a84b89c8e7c445815e55f5c4241a2431bf..0000000000000000000000000000000000000000
Binary files a/commons-fileupload-1.5-src.tar.gz and /dev/null differ
diff --git a/commons-fileupload-1.6.0-src.tar.gz b/commons-fileupload-1.6.0-src.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..efb2ac552130f5b87d4b33028f9722665b8915e2
Binary files /dev/null and b/commons-fileupload-1.6.0-src.tar.gz differ