you will need to change org.apache.commons-fileupload module.xml to have also dependancy to commons io.
In general you should be packaging these with your app rather than relying on the application servers version, as the servers version could be changed or be removed at any point, unless it is explicitly marked as a public module.
The modification of "file-upload" module fixes the problem of course, but I wanted to provide a package "EAR" out of the box without modifying a lot the configuration of JBoss AS.
The problem is that another EAR (from another product, GateIN) rely on the predefined "file-upload" module and as you know two JARs loaded in ClassLoaders (interdependent) makes problem especially for Casting and operations like "Class.isAssignableFrom".
If you've encountered actual casting problems, please start a new topic on GateIn forum, describing in more detail your setup - i.e. what version of GateIn you're using, the stack trace ...
Maybe this is a GateIn issue - inadvertently leaking third party jars to user applications.