CVE-2023-50164

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	>= 2.0.0, <= 2.5.32; >= 6.0.0, <= 6.3.0.1

References

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhjMailing List, Patch
https://security.netapp.com/advisory/ntap-20231214-0010/Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2023/12/07/1Mailing List
http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhjMailing List, Patch
https://security.netapp.com/advisory/ntap-20231214-0010/Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2023/12/07/1Mailing List

Timeline

Published: Dec 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-501658.6Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.CVE-2023-501666.1Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2023-501676.1Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.CVE-2023-501687.7Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.CVE-2023-50179.8A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the f CVE-2023-501725.3A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master co CVE-2023-501755.4Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and th CVE-2023-501768.8A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows a CVE-2023-501787.4An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 a CVE-2023-501795.9An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow CVE-2023-50189.8A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part CVE-2023-501805.5An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, v