CVE-2008-6505 Public exploit EPSS 72.7%

Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote…

Summary

The flaw is a set of directory traversal vulnerabilities in Apache Struts, affecting 2.0.x releases before 2.0.12 and 2.1.x releases before 2.1.3, located in FilterDispatcher (2.0.x) and DefaultStaticContentLoader (2.1.x). An attacker with remote network access can read arbitrary files by sending a crafted URI containing an encoded dot-dot-slash (..%252f) under a /struts/ path, with no authentication or user interaction indicated as required.

Official description · CVE.org

Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 5 months before disclosure.

Public exploit codeExploit-DB4 Nov 20085 mo before
Disclosed23 Mar 2009day 0

5 fixes in struts2-core over 3 years. The latest fix listed for struts2-core is 2.2.3.1.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.1.1CVE-2008-66829 Apr 2009
2.1.3CVE-2008-650523 Mar 2009
2.2.1CVE-2010-187017 Aug 2010
2.2.3CVE-2011-177213 May 2011
2.2.3.1CVE-2012-03918 Jan 2012KEVLatest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-wv7g-xhvw-8hcp

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2010-1870, CVE-2011-3923, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.1.3 for CVE-2008-6505.

Affected versions, by release line

If you run	Upgrade to
2.1.0 up to 2.1.3	2.5.33first fix for this CVE: 2.1.3
2.0.0 up to 2.0.12 Still affected on this line by CVE-2010-1870 (fixed in 2.2.1, a newer line); CVE-2011-3923 (fixed in 2.3.1.2, a newer line); CVE-2012-0391 (fixed in 2.2.3.1, a newer line); CVE-2012-0392 (fixed in 2.2.3.1, a newer line); CVE-2013-1965 (fixed in 2.3.14.3, a newer line); CVE-2013-1966 (fixed in 2.3.14.2, a newer line); CVE-2013-2115 (fixed in 2.3.14.2, a newer line); CVE-2013-2134 (fixed in 2.3.14.3, a newer line); CVE-2013-2248 (fixed in 2.3.15.1, a newer line); CVE-2013-2251 (fixed in 2.3.15.1, a newer line); CVE-2014-0094 (fixed in 2.3.16.2, a newer line); CVE-2014-0112 (fixed in 2.3.20, a newer line); CVE-2014-0113 (fixed in 2.3.20, a newer line); CVE-2017-12611 (fixed in 2.3.34, a newer line); CVE-2018-11776 (fixed in 2.3.35, a newer line); CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).	2.0.12

If you run

Upgrade to

2.1.0 up to 2.1.3

2.5.33first fix for this CVE: 2.1.3

2.0.0 up to 2.0.12

Still affected on this line by CVE-2010-1870 (fixed in 2.2.1, a newer line); CVE-2011-3923 (fixed in 2.3.1.2, a newer line); CVE-2012-0391 (fixed in 2.2.3.1, a newer line); CVE-2012-0392 (fixed in 2.2.3.1, a newer line); CVE-2013-1965 (fixed in 2.3.14.3, a newer line); CVE-2013-1966 (fixed in 2.3.14.2, a newer line); CVE-2013-2115 (fixed in 2.3.14.2, a newer line); CVE-2013-2134 (fixed in 2.3.14.3, a newer line); CVE-2013-2248 (fixed in 2.3.15.1, a newer line); CVE-2013-2251 (fixed in 2.3.15.1, a newer line); CVE-2014-0094 (fixed in 2.3.16.2, a newer line); CVE-2014-0112 (fixed in 2.3.20, a newer line); CVE-2014-0113 (fixed in 2.3.20, a newer line); CVE-2017-12611 (fixed in 2.3.34, a newer line); CVE-2018-11776 (fixed in 2.3.35, a newer line); CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

2.0.12

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

7 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-5640

Struts 2.0.11 - Multiple Directory Traversal VulnerabilitiesEDB-32565 · remote · multiple · 2008-11-04 · verified

, 30 Oct 2026

72.7%Top 0.56%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.44%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9944 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 23 Mar 2009
Modified: 7 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_CONFIRM 2

vdb-entry 4

third-party-advisory 1

techniques