CVE-2023-49735

🗓️ 30 Nov 2023 22:15:00Reported by ubuntu.comType

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. This affects Apache Tiles from version 2 onwards and products that are no longer supported by the maintainer

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 1.1 Vulnerabilities in IBM Library Support for Struts	16 Jan 202609:15	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 1.3.10 Vulnerabilities in IBM Library Support for Struts	16 Jan 202609:28	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	13 Mar 202617:06	–	ibm
Circl	CVE-2023-49735	21 Dec 202315:11	–	circl
CNNVD	Apache Tiles Path Traversal Vulnerability	30 Nov 202300:00	–	cnnvd
CVE	CVE-2023-49735	30 Nov 202321:17	–	cve
Cvelist	CVE-2023-49735 Apache Tiles: Unvalidated input may lead to path traversal and XXE	30 Nov 202321:17	–	cvelist
Debian CVE	CVE-2023-49735	30 Nov 202321:17	–	debiancve
Github Security Blog	Apache Tiles: Unvalidated input may lead to path traversal and XXE	1 Dec 202300:31	–	github
Tenable Nessus	Atlassian Jira Service Management Data Center and Server 11.2.0 < 11.2.1 (JSDSERVER-16458)	6 Feb 202600:00	–	nessus

OS	OS Version	Architecture	Package	Filename
Ubuntu	22.04	any	tiles	tiles_0_any.deb
Ubuntu	24.04	any	tiles	tiles_0_any.deb
Ubuntu	18.04	any	tiles	tiles_0_any.deb
Ubuntu	20.04	any	tiles	tiles_0_any.deb
Ubuntu	26.04	any	tiles	tiles_0_any.deb
Ubuntu	25.10	any	tiles	tiles_0_any.deb

Source	Link
lists	www.lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p
cve	www.cve.org/CVERecord

04 Aug 2025 18:53Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.01356

SSVC