Read the docs
TI-2024-35877 Aliases CVE-2024-53677GHSA-43mq-6xmg-29vm

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

Priority HIGH 81CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution, Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434 and CWE-915.

Summary

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.72367 99th percentileScored 2026-11-07
Fix Fixed Apache Struts (Apache Software Foundation): 6.4.0org.apache.struts:struts2-core (Maven): 6.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.0.0 to before 6.4.06.4.0Patch availableCNA
—org.apache.struts:struts2-core (Maven)before 6.4.06.4.0Patch availableGHSA-43mq-6xmg-29vm
  • Apache Struts VendorApache Affected 2.0.0 to before 6.4.0 Fixed in 6.4.0 Patch available CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected before 6.4.0 Fixed in 6.4.0 Patch available GHSA-43mq-6xmg-29vm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*2.0.0 to before 6.4.0VulnerableApache
  • cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.0.0 to before 6.4.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Struts (Apache Software Foundation) Fixed in 6.4.0
  • Fix · GHSA-43mq-6xmg-29vm org.apache.struts:struts2-core (Maven) Fixed in 6.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 19 products
  • A-MQ Clients 2
  • Red Hat AMQ Broker 7
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Web Server 5
  • Red Hat JBoss Web Server 6
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Debezium 2
  • Red Hat build of OptaPlanner 8
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53677
  2. 2026-10-03 Alias added: GHSA-43mq-6xmg-29vm
  3. 2026-11-03 CISA SSVC decision points changed

References

Advisory 3

Other 7

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences