cve.bz

CVE-2023-50164

9.8 criticalEPSS 81%

Critical (9.8) in apache struts. EPSS 81% chance of exploitation in the next 30 days. Fixed in org.apache.struts:struts2-core 2.5.33, 6.3.0.2.

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
81% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-552
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2j39-qcjm-428wMavenorg.apache.struts:struts2-core>=2.0.0 <2.5.332.5.33
GHSA-2j39-qcjm-428wMavenorg.apache.struts:struts2-core>=6.0.0 <6.3.0.26.3.0.2

References

Check your stackJSON