{"id":"CVE-2023-50164","published":"2023-12-07T08:49:19Z","modified":"2025-03-14T03:55:16Z","title":"Apache Struts: File upload component had a directory traversal vulnerability","vendor":"Apache Software Foundation","product":"Apache Struts","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Struts","versions":[">= 2.0.0, <= 2.5.32",">= 6.0.0, <= 6.3.0.1"]}],"description":{"text":"An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\nUsers are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Struts has a directory traversal flaw in its file upload component, where manipulated upload parameters can cause files to be written to unintended paths. An attacker who can submit crafted upload requests to an affected application may, under certain circumstances, upload a malicious file that enables remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:43Z"},"cvss":null,"epss":{"score":0.80819,"percentile":0.99627,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-31","exploitedFirstSeen":"2024-01-31","ransomware":false,"evidence":[{"url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","date":"2024-01-31"},{"url":"https://blog.cloudflare.com/application-security-report-2024-update","date":"2024-07-11"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","date":"2024-11-20"},{"url":"https://isc.sans.edu/diary/Exploit+attempts+inspired+by+recent+Struts2+File+Upload+Vulnerability+CVE202453677+CVE202350164/31520","date":"2024-12-15"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2023-50164","date":"2025-06-08"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":20,"pulses":[{"name":"New Chaos RAT Variants Threaten Windows and Linux Systems with Stealthy Data Theft","url":"https://otx.alienvault.com/pulse/6843300336b121603e3cffad","created":"2025-06-06"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7b1080740c101e9e9","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7393d00df56cffdc0","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7a55e1301c9233e6c","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f78bbff8f3a7dcb4c3","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f6a7ad2f6c63bac5d6","created":"2024-12-21"},{"name":"CISA Adds 8 Vulnerabilities to Exploited List, Plus an Apache Struts2 Vulnerability Expected to be Added in the Future","url":"https://otx.alienvault.com/pulse/6763151578f3ce5dfbb14bde","created":"2024-12-18"},{"name":"Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm Center","url":"https://otx.alienvault.com/pulse/6762beefe124b068a2a44f8e","created":"2024-12-18"},{"name":"Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm Center","url":"https://otx.alienvault.com/pulse/676041a7afcf16fd2894ad64","created":"2024-12-16"},{"name":"BlueNoroff used macOS malware with novel persistence","url":"https://otx.alienvault.com/pulse/672d552ee02b6697ba5e6474","created":"2024-11-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj","tags":["vendor-advisory","mailing-list"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/07/1","tags":[]},{"url":"http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0010/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.5.33",">=6.0.0, <6.3.0.2"],"patched":["2.5.33","6.3.0.2"],"from":["GHSA-2j39-qcjm-428w"],"provenance":"source"}],"advisories":[{"id":"GHSA-2j39-qcjm-428w","url":"https://github.com/advisories/GHSA-2j39-qcjm-428w","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.5.33"],"patched":["2.5.33"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2j39-qcjm-428w","url":"https://github.com/advisories/GHSA-2j39-qcjm-428w","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=6.0.0, <6.3.0.2"],"patched":["6.3.0.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-3074","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-3074","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":14,"skipped":1,"earliest":"2023-12-13","earliestUrl":"https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE","repos":[{"name":"jakabakos/CVE-2023-50164-Apache-Struts-RCE","url":"https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE","stars":84,"created":"2023-12-13"},{"name":"dwisiswant0/cve-2023-50164-poc","url":"https://github.com/dwisiswant0/cve-2023-50164-poc","stars":57,"created":"2023-12-17"},{"name":"Trackflaw/CVE-2023-50164-ApacheStruts2-Docker","url":"https://github.com/Trackflaw/CVE-2023-50164-ApacheStruts2-Docker","stars":6,"created":"2023-12-20"},{"name":"snyk-labs/CVE-2023-50164-POC","url":"https://github.com/snyk-labs/CVE-2023-50164-POC","stars":6,"created":"2023-12-30"},{"name":"bcdannyboy/CVE-2023-50164","url":"https://github.com/bcdannyboy/CVE-2023-50164","stars":4,"created":"2023-12-15"}]},"first":{"date":"2023-12-13","source":"PoC-in-GitHub","url":"https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2023-12-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-50164","provenance":"source"},{"date":"2023-12-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE","provenance":"source"},{"date":"2024-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":62.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1003 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 14 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"20 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-34149","published":"2023-06-14","fixed":"6.1.2.1","kev":false},{"cve":"CVE-2023-34396","published":"2023-06-14","fixed":"6.1.2.1","kev":false},{"cve":"CVE-2023-41835","published":"2023-12-05","fixed":"6.3.0.1","kev":false,"link":{"from":"CVE-2023-41835","to":"CVE-2023-50164","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.32","toFixed":"2.5.33","daysApart":2},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"6.3.0.1","toFixed":"6.3.0.2","daysApart":2}]}},{"cve":"CVE-2023-50164","published":"2023-12-07","fixed":"6.3.0.2","kev":false},{"cve":"CVE-2024-53677","published":"2024-12-11","fixed":"6.4.0","kev":false,"link":{"from":"CVE-2023-50164","to":"CVE-2024-53677","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"6.3.0.2","toFixed":"6.4.0","daysApart":370}]}},{"cve":"CVE-2025-64775","published":"2025-12-01","fixed":"7.1.1","kev":false},{"cve":"CVE-2025-66675","published":"2025-12-10","fixed":"7.1.1","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}