Servers and applications
CVE-2024-53677
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload…
- Severity
- Critical 9.5
- Published
- 11 Dec 2024
- Last changed
- 3 Nov 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 6.4.0
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache StrutsServers and applications · cpe:a:apache:struts |
|