Apache Struts: File upload component had a directory traversal vulnerability
Priority CRITICAL 89CWE-552Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-552.
Summary
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.80819 99th percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.5.33, 6.3.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Struts | 2.0.0 – 2.5.32; 6.0.0 – 6.3.0.1 | — | No fix listed | CNA |
| — | org.apache.struts:struts2-core (Maven) | 2.0.0 to before 2.5.33 | 2.5.33 | Patch available | GHSA-2j39-qcjm-428w |
| — | org.apache.struts:struts2-core (Maven) | 6.0.0 to before 6.3.0.2 | 6.3.0.2 | Patch available | GHSA-2j39-qcjm-428w |
- Apache Struts VendorApache Affected 2.0.0 – 2.5.32; 6.0.0 – 6.3.0.1 Fixed in — No fix listed CNA
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.0.0 to before 2.5.33 Fixed in 2.5.33 Patch available GHSA-2j39-qcjm-428w
- org.apache.struts:struts2-core (Maven) Vendor— Affected 6.0.0 to before 6.3.0.2 Fixed in 6.3.0.2 Patch available GHSA-2j39-qcjm-428w
Remediation
- Fix · GHSA-2j39-qcjm-428w org.apache.struts:struts2-core (Maven) Fixed in 2.5.33 Advisory →
- Fix · GHSA-2j39-qcjm-428w org.apache.struts:struts2-core (Maven) Fixed in 6.3.0.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
Not affected: 27 products
- A-MQ Clients 2
- Migration Toolkit for Applications 6
- Migration Toolkit for Runtimes
- OpenShift Serverless
- Red Hat AMQ Broker 7
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Decision Manager 7
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Web Server 5
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel for Spring Boot 3
- Red Hat build of Debezium 2
- Red Hat build of OptaPlanner 8
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2023-50164
- 2026-10-03 Alias added: GHSA-2j39-qcjm-428w
References
Advisory 3
Other 7
- https://www.openwall.com/lists/oss-security/2023/12/07/1
- https://github.com/apache/struts/commit/162e29fee9136f4bfd9b2376da2cbf590f9ea163
- https://github.com/apache/struts/commit/d8c69691ef1d15e76a5f4fcf33039316da2340b6
- https://cwiki.apache.org/confluence/display/WW/S2-066
- https://github.com/apache/struts
- https://security.netapp.com/advisory/ntap-20231214-0010
- http://www.openwall.com/lists/oss-security/2023/12/07/1
More Apache Struts vulnerabilities
- TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
Sources
- CVE-2023-50164 · CVE Program
- CVE-2023-50164 · NVD
- FIRST EPSS
- GHSA-2j39-qcjm-428w · GitHub Advisory Database · CC BY 4.0
- CVE-2023-50164 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences