Every CVE Search/ Get API key

CVE-2024-53677

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

9.5 CriticalPublic exploitFix available

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

72.4%Up 72.3 points since Dec 12, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.5

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Record
CVE-2024-53677
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
Weakness
CWE-434
Updated
2026-11-04
EUVDEUVD-2024-3418 9.5

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Record
EUVD-2024-3418
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
Updated
2026-11-04
GitHub AdvisoriesGHSA-43mq-6xmg-29vm 9.5

Apache Struts file upload logic is flawed

File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 .

Record
GHSA-43mq-6xmg-29vm
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-434, CWE-915
Updated
2026-11-02
NVD 9.5

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Record
CVE-2024-53677
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-04
OSV 9.5

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Record
CVE-2024-53677
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
Updated
2026-11-07
OSVGHSA-43mq-6xmg-29vm 9.5

Apache Struts file upload logic is flawed

File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 .

Record
GHSA-43mq-6xmg-29vm
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-434, CWE-915
Updated
2026-11-02
OSVCLSA-2025-1754006617 No score

TuxCare security update for org.apache.struts:struts2-core (1 CVE)

TuxCare rebuilt org.apache.struts:struts2-core to address 1 CVE. Fixed in 2.5.33-tuxcare.1.

Record
CLSA-2025-1754006617
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-core
Maven
 before 6.4.0
6.4.0
org.apache.struts:struts2-core
TuxCare:Maven
 2.5.33 up to 2.5.33-tuxcare.1
2.5.33-tuxcare.1
org.apache.struts:struts2-core
Maven
 before 6.4.0, plus listed versions
2.0.112.0.11.12.0.11.22.0.122.0.14
Show 45 moreShow less
2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36
6.4.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubcloudwafs/s2-067-CVE-2024-536772024-12-12
PoC in GitHubTAM-K592/CVE-2024-53677-S2-0672024-12-13
PoC in GitHubc4oocO/CVE-2024-53677-Docker2024-12-17
PoC in GitHubyangyanglo/CVE-2024-536772024-12-17
PoC in GitHubdustblessnotdust/CVE-2024-53677-S2-067-thread2024-12-18
PoC in GitHubhiteshpatra/CVE-2024-536772024-12-23
PoC in GitHubEQSTLab/CVE-2024-536772025-01-03
PoC in GitHub0xPThree/struts_cve-2024-536772025-01-07
PoC in GitHubSeanRickerd/CVE-2024-536772025-01-10
PoC in GitHubhopsypopsy8/CVE-2024-53677-Exploitation2025-02-13
Show 8 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubshishirghimir/CVE-2024-53677-Exploit2025-02-24
PoC in GitHubBuludX/CVE-2024-536772025-05-20
PoC in GitHubr007sec/CVE-2024-536772025-06-03
PoC in GitHubCythonic1/CVE-2024-53677-POC2025-09-01
PoC in GitHubseoyoung-kang/CVE-2024-536772025-10-15
PoC in GitHubsangrok-jeon/CVE-2024-53677-Analysis2026-03-18
PoC in GitHubctfsec/CVE-2024-536772026-05-02
PoC in GitHubchoyj358/cve-2024-536772026-10-13

History

History
RecordedChangedSources
exploits, factsCVE List, EUVD
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-53677 is a critical vulnerability (CVSS 9.5) in Apache Struts, published December 11, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.4%, the 99th percentile. Fixed in org.apache.struts:struts2-core 6.4.0.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 46 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open