Vulnerability Intelligence Report
Apache Struts: File upload component had a directory traversal vulnerability
CVE-2023-50164
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:80.82%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-552 ↗CWE-552 Files or Directories Accessible to External Parties
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 <= 2.5.32 (affected), 6.0.0 <= 6.3.0.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
80.819%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Apache Software Foundation · Vendor · USA |
| Reserved | 2023-12-04T08:37:57 |
| Published | 2023-12-07T08:49:19 |
| Last Updated | 2025-03-14T03:55:16 |
Community Chatter & Buzz