Apache Struts vulnerable to path traversal

CRITICAL 9.8CVE-2023-50164 · GHSA-2j39-qcjm-428w · Published 07/12/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.struts:struts2-core Maven	`≥ 2.0.0, < 2.5.33≥ 6.0.0, < 6.3.0.2`	`2.5.336.3.0.2`
struts apache	`≥ 2.0.0, < 2.5.33≥ 6.0.0, < 6.3.0.2`	`2.5.336.3.0.2`

Description

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-50164 · ADVISORY
apache/struts commit 162e29f · WEB
apache/struts commit d8c6969 · WEB
cwiki.apache.org/confluence/display/WW/S2-066 · WEB
apache/struts · PACKAGE
lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj · WEB
security.netapp.com/advisory/ntap-20231214-0010 · WEB
openwall.com/lists/oss-security/2023/12/07/1 · WEB
packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html · WEB
openwall.com/lists/oss-security/2023/12/07/1 · WEB
security.netapp.com/advisory/ntap-20231214-0010 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free