CVE-2012-1592
Unrestricted Upload of File with Dangerous Type in Apache Struts2
CVE-2012-1592 is a high vulnerability (CVSS 8.8) in Apache Struts, published December 5, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.5%, the 98th percentile. Fixed in org.apache.struts:struts2-core 2.5.22.
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
- Record
CVE-2012-1592- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
- Record
CVE-2012-1592- Updated
- 2026-11-02
EUVDEUVD-2022-1679 No score
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
- Record
EUVD-2022-1679- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8m5q-crqq-6pmf
Unrestricted Upload of File with Dangerous Type in Apache Struts2
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. A patch exists as of version 2.5.22.
- Record
GHSA-8m5q-crqq-6pmf- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSVGHSA-8m5q-crqq-6pmf
Unrestricted Upload of File with Dangerous Type in Apache Struts2
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. A patch exists as of version 2.5.22.
- Record
GHSA-8m5q-crqq-6pmf- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.0 up to 2.5.22 | 2.5.22 |
org.apache.struts:struts2-coreMaven |
2.0 up to 2.5.22, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36 |
2.5.22 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts 2.0 - 'XSLTResult.java' Arbitrary File Upload | 2012-03-23 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
security-tracker.debian.org/tracker/CVE-2012-1592
bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592
access.redhat.com/security/cve/cve-2012-1592
openwall.com/lists/oss-security/2012/03/28/12
lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-1592
github.com/apache/struts/blob/master/core/src/main/resources/struts-default.xml
issues.apache.org/jira/browse/WW-5055
seclists.org/bugtraq/2012/Mar/110
struts.apache.org/security
Left out here: 23 versions. The JSON record has them.