Every CVE Search/ Get API key

CVE-2023-50164

Apache Struts: File upload component had a directory traversal vulnerability

9.8 CriticalPublic exploitFix available

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

80.8%Up 80.7 points since Dec 8, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
CVE-2023-50164
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-552
Updated
2026-11-02
CVE List No score

Apache Struts: File upload component had a directory traversal vulnerability

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
CVE-2023-50164
Weakness
CWE-552
Updated
2026-11-02
EUVDEUVD-2023-3074 No score

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
EUVD-2023-3074
Updated
2026-11-02
GitHub AdvisoriesGHSA-2j39-qcjm-428w 9.8

Apache Struts vulnerable to path traversal

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
GHSA-2j39-qcjm-428w
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-552
Updated
2026-11-02
OSVGHSA-2j39-qcjm-428w 9.8

Apache Struts vulnerable to path traversal

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
GHSA-2j39-qcjm-428w
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-552
Updated
2026-11-02
OSV No score

Apache Struts: File upload component had a directory traversal vulnerability

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Record
CVE-2023-50164
Weakness
CWE-552
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-core
Maven
 6.0.0 up to 6.3.0.2
6.3.0.2
org.apache.struts:struts2-core
Maven
 2.0.0 up to 2.5.33
2.5.33
org.apache.struts:struts2-core
Maven
 2.0.0 up to 2.5.33, plus listed versions
2.0.112.0.11.12.0.11.22.0.122.0.14
Show 45 moreShow less
2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36
2.5.33
org.apache.struts:struts2-core
Maven
 6.0.0 up to 6.3.0.2, plus listed versions
6.0.36.1.16.1.26.1.2.16.1.2.26.2.06.3.06.3.0.1
6.3.0.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAsfandAliMemon25/CVE-2023-50164Analysis-2024-04-16
PoC in GitHubMKIRAHMET/CVE-2023-50164-HTB-strutted2025-09-04
PoC in GitHubNikitaPark/CVE-2023-50164-PoC2024-10-06
PoC in GitHubPixel-DefaultBR/CVE-2023-501642025-03-05
PoC in GitHubThirukrishnan/CVE-2023-50164-Apache-Struts-RCE2023-12-20
PoC in GitHubTrackflaw/CVE-2023-50164-ApacheStruts2-Docker2023-12-20
PoC in GitHubTrackflaw/CVE-2024-10924-Wordpress-Docker2024-11-20
PoC in GitHubaaronm-sysdig/cve-2023-501642023-12-22
PoC in GitHubbcdannyboy/CVE-2023-501642023-12-15
PoC in GitHubdwisiswant0/cve-2023-50164-poc2023-12-17
Show 5 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubhelsecert/cve-2023-501642023-12-18
PoC in GitHubhybinn/CVE-2023-501642025-10-09
PoC in GitHubjakabakos/CVE-2023-50164-Apache-Struts-RCE2023-12-13
PoC in GitHubsnyk-labs/CVE-2023-50164-POC2023-12-30
PoC in GitHubsunnyvale-it/CVE-2023-50164-PoC2024-01-12

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50164 is a critical vulnerability (CVSS 9.8) in Apache Struts, published December 7, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 80.8%, the 99th percentile. Fixed in org.apache.struts:struts2-core 6.3.0.2.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 35 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open