CVE-2025-68493
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Missing XML validation in Apache Struts allows XML External Entity (XXE) attacks or other XML data manipulation. The vulnerability affects versions from 2.0.0 up to and including 6.1.0.
Risk Assessment
An attacker can remotely read sensitive files on the server, perform Server-Side Request Forgery (SSRF), or cause a denial of service (DoS).
Recommendation
Immediately upgrade Apache Struts to version 6.1.1 or later, which contains the fix.
Other vulnerabilities in Apache Struts
See all- CVE-2016-3090High
The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.
- CVE-2016-4461High
Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2017-9804High
In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.
- CVE-2015-5209High
Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.
- CVE-2017-9787High
Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.
- CVE-2016-4433High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
- CVE-2016-4431High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
- CVE-2016-4430High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
- CVE-2016-3081High
Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- CVE-2016-0785High
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
Original NVD description (English source)
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.