The commons-file-upload library is now at version 1.4 and Openfire should be updated to use this version.
https://commons.apache.org/proper/commons-fileupload/