UpHeron
All vulnerabilities

Servers and applications

CVE-2023-50164

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Severity
Critical 9.8
Published
7 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.5.33, 6.3.0.2
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • From 2.0.0 before 2.5.33
  • From 6.0.0 before 6.3.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-50164
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-50164