CVE-2023-50164

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this...

CVE-2023-50164

The Apache Struts 2 framework is vulnerable to a directory traversal flaw within its file upload logic. An attacker can manipulate file upload parameters to traverse directories and upload malicious files, which may lead to Remote Code Execution (RCE) . Active exploitation attempts have been obse...