# CVE-2023-50164

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

- Page: https://www.vulneraibility.com/cve/CVE-2023-50164
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 80.82% (percentile 99.6)
- Unvetted proof-of-concept code on GitHub: 15 GitHub proofs of concept (first 2023-12-13)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2024-12-16)
- Weakness: CWE-552
- Published: 2023-12-07

## Affected versions

- Apache Software Foundation Apache Struts: affected >= 2.0.0 and <= 2.5.32; >= 6.0.0 and <= 6.3.0.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
- [other] https://www.openwall.com/lists/oss-security/2023/12/07/1
- [other] http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
- [other] https://security.netapp.com/advisory/ntap-20231214-0010/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.