CVE-2023-50164
Fixed upstream EPSS 81%
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Products: Apache Software Foundation Apache Struts
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.5.33 |
| Maven | org.apache.struts:struts2-core | 6.3.0.2 |