CVE-2023-50164

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

93.66%

CWE

CWE-552

Published

2023-12-07

Last modified

2026-09-17

Affected products

• Apache Software Foundation Apache Struts
• Apache Software Foundation Apache Struts

Weakness type

• CWE-552

Related vulnerabilities

• CVE-2024-6911 — Unauthenticated Local File Inclusion
• CVE-2024-6209 — unauthorized file access
• CVE-2025-34110 — ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
• CVE-2025-68109 — ChurchCRM vulnerable to RCE with database restore functionality
• CVE-2023-2766 — Weaver OA jx2_config.ini file access
• CVE-2009-10005 — ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode
• CVE-2023-48710 — iTop limit pages/exec.php script to PHP files
• CVE-2020-37082 — webERP 4.15.1 - Unauthenticated Backup File Access

Markdown version · Browse all CVEs