src/web/plugin-admin.jsp is using packet org.apache.commons.fileupload
This is located in these two libraries:
Both libraries include an LICENSE.txt which claims them as Apache License v2.0. Openfire itself is currently licensed under GnuGPLv2. According to wikipedia these two are not compatible! Migrating Openfire to GPLv3 would probably solve this problem. Another solution would be using other libraries.
Also several plugins (clientControl, fastpath and userImportExport) are using an older commons-fileupload-1.0.jar, which claims to be Apache License v1.1. I found no information about this is compatible to GPLv2.
See also this forums thread.
I am no lawyer but Todd Getz thinks also I'm are correct.
Jetty is also under Apache License v2.0
adjusting versions, this should be looked at IMHO. There is also another ticket along these lines from the debian folks
Marking this as fixed in next release with migration to AP2