CVE-2025-68493
Fixed upstream EPSS 50%CVSS 8.1
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Products: Apache Software Foundation Apache Struts, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.opensymphony:xwork | no fix |
| Maven | org.apache.struts.xwork:xwork-core | no fix |
| Maven | org.apache.struts:struts2-core | no fix |
| Maven | org.apache.struts:struts2-core | 6.1.1 |