VULNERABILITY INTELLIGENCE

CVE-2023-50164

CVSS score9.8 CRITICAL
EPSS probability80.82%
CISA KEVNot currently listed
Published2023-12-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Weakness classification

  • security@apache.org: CWE-552

Primary references