CVE-2008-6505
Apache Struts directory traversal vulnerability
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- Record
CVE-2008-6505- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- Record
CVE-2008-6505- Updated
- 2026-11-02
EUVDEUVD-2022-5640 No score
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- Record
EUVD-2022-5640- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wv7g-xhvw-8hcp No score
Apache Struts directory traversal vulnerability
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- Record
GHSA-wv7g-xhvw-8hcp- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-wv7g-xhvw-8hcp No score
Apache Struts directory traversal vulnerability
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
- Record
GHSA-wv7g-xhvw-8hcp- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.0.12 | 2.0.12 |
org.apache.struts:struts2-coreMaven |
2.1.0 up to 2.1.3 | 2.1.3 |
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.0.12, plus listed versions 2.0.112.0.11.12.0.11.22.0.52.0.62.0.82.0.9 |
2.0.12 |
org.apache.struts:struts2-coreMaven |
2.1.0 up to 2.1.3, plus listed versions 2.1.2 |
2.1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities | 2008-11-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-6505 is a medium vulnerability (CVSS 5.0) in Apache Struts, published March 23, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.7%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.0.12.
References
issues.apache.org/struts/browse/WW-2779
struts.apache.org/2.x/docs/s2-004.html
vupen.com/english/advisories/2008/3003
secunia.com/advisories/32497
securityfocus.com/bid/32104
osvdb.org/49733
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2008-6505
github.com/apache/struts/commit/04fcefa44bae1263c7cad6986a9dafed67f0164f
web.archive.org/web/20081208214512/http://secunia.com/advisories/32497