Read the docs
TI-2016-05836 Aliases CVE-2016-6795GHSA-44hv-jjx7-qfjg

Path traversal in Apache Struts

Priority MEDIUM 53CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.

Why it matters now

EPSS 0.08219 94th percentileScored 2026-11-07
Fix Fixed Apache Struts (Apache Software Foundation): 2.3.31, 2.5.5org.apache.struts:struts2-convention-plugin (Maven): 2.3.31, 2.5.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.3 to before 2.3.31; 2.5 to before 2.5.52.3.31, 2.5.5Patch availableCNA
—org.apache.struts:struts2-convention-plugin (Maven)2.3.0 to before 2.3.312.3.31Patch availableGHSA-44hv-jjx7-qfjg
—org.apache.struts:struts2-convention-plugin (Maven)2.5.0 to before 2.5.52.5.5Patch availableGHSA-44hv-jjx7-qfjg
  • Apache Struts VendorApache Affected 2.3 to before 2.3.31; 2.5 to before 2.5.5 Fixed in 2.3.31, 2.5.5 Patch available CNA
  • org.apache.struts:struts2-convention-plugin (Maven) Vendor— Affected 2.3.0 to before 2.3.31 Fixed in 2.3.31 Patch available GHSA-44hv-jjx7-qfjg
  • org.apache.struts:struts2-convention-plugin (Maven) Vendor— Affected 2.5.0 to before 2.5.5 Fixed in 2.5.5 Patch available GHSA-44hv-jjx7-qfjg

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*2.3.20VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*2.3.20.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*2.3.20.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*2.3.20.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*2.3.21VulnerableApache
cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*2.3.22VulnerableApache
cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*2.3.23VulnerableApache
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*2.3.24VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*2.3.24.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*2.3.24.2VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* Versions 2.3.20.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* Versions 2.3.20.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* Versions 2.3.20.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* Versions 2.3.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* Versions 2.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* Versions 2.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* Versions 2.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* Versions 2.3.24.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* Versions 2.3.24.2 Vulnerable ·Apache
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*2.3.24.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*2.3.25VulnerableApache
cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*2.3.26VulnerableApache
cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*2.3.27VulnerableApache
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*2.3.28VulnerableApache
cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*2.3.28.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*2.3.29VulnerableApache
cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*2.3.30VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* Versions 2.3.24.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* Versions 2.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* Versions 2.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* Versions 2.3.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* Versions 2.3.28.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Struts (Apache Software Foundation) Fixed in 2.3.31, 2.5.5
  • Fix · GHSA-44hv-jjx7-qfjg org.apache.struts:struts2-convention-plugin (Maven) Fixed in 2.3.31 Advisory →
  • Fix · GHSA-44hv-jjx7-qfjg org.apache.struts:struts2-convention-plugin (Maven) Fixed in 2.5.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6795
  2. 2026-10-03 Alias added: GHSA-44hv-jjx7-qfjg

References

Advisory 2

Other 6

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences