Connect with us

Hi, what are you looking for?



Apache Patches Critical RCE Vulnerability in Struts 2

Apache has addressed a critical-severity Struts 2 file upload vulnerability that could lead to remote code execution.

The Apache Software Foundation over the weekend announced security updates that address a critical-severity file upload vulnerability in the Struts 2 open source development framework, warning that it could be exploited to execute arbitrary code remotely.

The issue, tracked as CVE-2023-50164, is described as a flaw in the file upload logic, which could allow an “attacker to enable paths with traversals”. No technical details have been published.

“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution,” Apache explains in its advisory.

According to the organization, the bug impacts Struts versions 2.0.0 to 2.3.37 (which reached end of life), Struts versions 2.5.0 to 2.5.32, and Struts versions 6.0.0 to 6.3.0.

The vulnerability was patched with the release of Struts versions 2.5.33 and

Apache has credited Steven Seeley of Source Incite for reporting the vulnerability. The researcher recommends that all Struts 2 users update to a patched release.

In a separate announcement, Apache urges all users to update to the latest web application framework versions, noting that no issues should arise when performing the upgrade.

“This is a drop-in replacement and upgrade should be straightforward. All developers are strongly advised to perform this upgrade,” the organization says.

Advertisement. Scroll to continue reading.

Apache makes no mention of this vulnerability being exploited in malicious attacks, but Struts flaws have been targeted in the wild, including in attacks against the US credit reporting agency Equifax.

Related: Attackers Exploiting Critical F5 BIG-IP Vulnerability

Related: Recently Patched TeamCity Vulnerability Exploited to Hack Servers

Related: Critical Vulnerability Found in Ray AI Framework

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.