CVE-2008-6505
apache struts: no CVSS score yet. EPSS 73% chance of exploitation in the next 30 days. Fixed in org.apache.struts:struts2-core 2.0.12, 2.1.3.
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- EPSS
- 73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wv7g-xhvw-8hcp | Maven | org.apache.struts:struts2-core | >=2.0.0 <2.0.12 | 2.0.12 |
| GHSA-wv7g-xhvw-8hcp | Maven | org.apache.struts:struts2-core | >=2.1.0 <2.1.3 | 2.1.3 |