CVE-2025-68493

HighCVSS 8.1

Published: 11/01/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

23.05%

98th percentile - higher than 98% of all known CVEs

Summary

Missing XML validation in Apache Struts allows XML External Entity (XXE) attacks or other XML data manipulation. The vulnerability affects versions from 2.0.0 up to and including 6.1.0.

Risk Assessment

An attacker can remotely read sensitive files on the server, perform Server-Side Request Forgery (SSRF), or cause a denial of service (DoS).

Recommendation

Immediately upgrade Apache Struts to version 6.1.1 or later, which contains the fix.

Original NVD description (English source)

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.