CVE-2025-68493

🗓️ 11 Jan 2026 13:05:36Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 441 Views🌐 WEB

XXE in outdated XWork and missing validation affect Apache Struts; upgrade to 6.1.1.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	9 Mar 202610:35	–	ibm
Atlassian	CVE-2025-68493 impact on Bamboo	13 Feb 202611:45	–	atlassian
Atlassian	Missing XML Validation vulnerability in Apache Struts Dependency in Bamboo Data Center	11 Mar 202613:10	–	atlassian
Tenable Nessus	Atlassian Bamboo 9.6.x < 9.6.24 / 10.x < 10.2.16 / 11.x / 12.x < 12.1.3 Multiple Vulnerabilities	25 Mar 202600:00	–	nessus
Tenable Nessus	Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.1.1 XML External Entity Injection in XWork (S2-069)	16 Jan 202600:00	–	nessus
BDU FSTEC	The vulnerability of the Apache Struts software platform, related to the lack of authenticity checking for XML documents, allows attackers to execute XXE attacks.	14 Jan 202600:00	–	bdu_fstec
GithubExploit	Exploit for Missing XML Validation in Apache Struts	4 Feb 202601:57	–	githubexploit
Circl	CVE-2025-68493	11 Jan 202615:34	–	circl
CNNVD	Apache Struts 安全漏洞	11 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-68493 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component	11 Jan 202613:05	–	cvelist

NVD

Vulners

Node

apache strutsRange2.0.0–2.3.37

apache strutsRange2.5.0–2.5.33

apache strutsRange6.0.0–6.1.1

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "com.opensymphony:xwork",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.2.1",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.struts.xwork:xwork-core",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "6.1.0",
        "status": "affected",
        "version": "2.2.1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-069
access	www.access.redhat.com/security/cve/CVE-2025-68493
openwall	www.openwall.com/lists/oss-security/2026/01/11/2
security	www.security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

Parameter	Position	Path	Description	CWE
xml	request body	/struts2-xml-parser/xmlParserNoDtdParse	XXE vulnerability via missing XML validation in Struts leading to remote file read	CWE-112, CWE-611

15 Jul 2026 02:17Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.18.1

EPSS0.23054

SSVC