Patchfirst
Patchfirst
CVE-2023-50164 Public exploit EPSS 80.8%

Apache Struts: File upload component had a directory traversal vulnerability

Apache Software Foundation · Apache Struts

Summary

Apache Struts has a directory traversal flaw in its file upload component, where manipulated upload parameters can cause files to be written to unintended paths. An attacker who can submit crafted upload requests to an affected application may, under certain circumstances, upload a malicious file that enables remote code execution.

Official description · CVE.org

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Breakdown
62.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 55 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+6 days
  3. First seen exploitedVulnCheck KEV evidence+55 days

7 fixes in struts2-core over 2 years. The latest fix listed for struts2-core is 7.1.1.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 6.1.2.1CVE-2023-3414914 Jun 2023
  2. 6.1.2.1CVE-2023-3439614 Jun 2023
  3. 6.3.0.1CVE-2023-418355 Dec 2023
  4. 6.3.0.2CVE-2023-501647 Dec 2023
  5. 6.4.0CVE-2024-5367711 Dec 2024
  6. 7.1.1CVE-2025-647751 Dec 2025
  7. 7.1.1CVE-2025-6667510 Dec 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-2j39-qcjm-428w

Upgrade to 6.4.0 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2024-53677, CVE-2025-68493).

Set the version to 6.4.0 or later in your pom.xml or build.gradle.

First fixed in 6.3.0.2 for CVE-2023-50164.

Affected versions, by release line

If you runUpgrade to
6.0.0 up to 6.3.0.26.4.0first fix for this CVE: 6.3.0.2
2.0.0 up to 2.5.33

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

2.5.33

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 20 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

vendor-advisory 1

lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj

Other 3

openwall.com/lists/oss-security/2023/12/07/1packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlsecurity.netapp.com/advisory/ntap-20231214-0010/
↑ ↓ chooseEnter openEsc close