Apache Struts file upload logic is flawed

NGHIÊM TRỌNG 9.8CVE-2024-53677 · GHSA-43mq-6xmg-29vm · Công bố 11/12/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-53677 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng org.apache.struts:struts2-core, struts (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 72.4%, cao hơn 99.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.struts:struts2-core Maven	`< 6.4.0`	`6.4.0`
struts apache	`≥ 2.0.0, < 6.4.0`	`6.4.0`

Mô tả

File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .

Mô tả của NVD

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067