CVE-2023-50164— Apache Struts: File upload component had a directory traversal vulnerability
Quick assessment
Affected
Apache Software Foundation Apache Struts
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Struts是美国阿帕奇（Apache）基金会的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts 存在安全漏洞，该漏洞源于file upload参数存在路径遍历漏洞。攻击者可利用该漏洞上传恶意文件并执行远程代码。受影响的产品和版本：Apache Struts 2.0.0至2.5.32版本，6.0.0至6.3.0.1版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-50164
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Struts: File upload component had a directory traversal vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Struts 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Struts是美国阿帕奇（Apache）基金会的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts 存在安全漏洞，该漏洞源于file upload参数存在路径遍历漏洞。攻击者可利用该漏洞上传恶意文件并执行远程代码。受影响的产品和版本：Apache Struts 2.0.0至2.5.32版本，6.0.0至6.3.0.1版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 ~ 2.5.32 | - |
|
II. Public POCs for CVE-2023-50164
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE). | https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE | POC Details |
| 2 | A scanning utility and PoC for CVE-2023-50164 | https://github.com/bcdannyboy/CVE-2023-50164 | POC Details |
| 3 | Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164") | https://github.com/dwisiswant0/cve-2023-50164-poc | POC Details |
| 4 | None | https://github.com/helsecert/cve-2023-50164 | POC Details |
| 5 | None | https://github.com/Thirukrishnan/CVE-2023-50164-Apache-Struts-RCE | POC Details |
| 6 | Vulnerable docker container for Apache Struts 2 RCE CVE-2023-50164 | https://github.com/Trackflaw/CVE-2023-50164-ApacheStruts2-Docker | POC Details |
| 7 | None | https://github.com/miles3719/cve-2023-50164 | POC Details |
| 8 | None | https://github.com/aaronm-sysdig/cve-2023-50164 | POC Details |
| 9 | None | https://github.com/snyk-labs/CVE-2023-50164-POC | POC Details |
| 10 | CVE-2023-50164 (Apache Struts path traversal to RCE vulnerability) - Proof of Concept | https://github.com/sunnyvale-it/CVE-2023-50164-PoC | POC Details |
| 11 | None | https://github.com/n-etupirka/CVE-2023-50164 | POC Details |
| 12 | None | https://github.com/AsfandAliMemon25/CVE-2023-50164Analysis- | POC Details |
| 13 | None | https://github.com/minhbao15677/CVE-2023-50164 | POC Details |
| 14 | CVE-2023-50164 PoC Application & Exploit script | https://github.com/NikitaPark/CVE-2023-50164-PoC | POC Details |
| 15 | Vulnerable docker container for Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass CVE-2023-50164 | https://github.com/Trackflaw/CVE-2024-10924-Wordpress-Docker | POC Details |
| 16 | Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164") | https://github.com/powerlesssta/cve-2023-50164-poc | POC Details |
| 17 | Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164") | https://github.com/separatefailu/cve-2023-50164-poc | POC Details |
| 18 | None | https://github.com/Pixel-DefaultBR/CVE-2023-50164 | POC Details |
| 19 | Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164") | https://github.com/heavyyeast/cve-2023-50164-poc | POC Details |
| 20 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Struts%20S2-066%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2023-50164.md | POC Details |
| 21 | Proof-of-concept for CVE-2023-50164 (Apache Struts 2), originally by jakabakos and adapted for the HTB Strutted lab environment. For educational use only. | https://github.com/MKIRAHMET/CVE-2023-50164-HTB-strutted | POC Details |
| 22 | None | https://github.com/hybinn/CVE-2023-50164 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-50164
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-50164 (1)
Exploits & Public PoCs for CVE-2023-50164 (1)
Mailing List Discussions for CVE-2023-50164 (2)
IV. Related Vulnerabilities
Same product: Apache Struts
-
CVE-2026-104714
Apache Struts: Shared message formatter exposes date and tim -
CVE-2026-104713
Apache Struts: Unbounded request body read in the REST plugi -
CVE-2026-104712
Apache Struts: Disproportionate response size when rendering -
CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action m -
CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin
Same vendor: Apache Software Foundation
-
CVE-2026-113582
Apache Abdera: XML external entity expansion in Atom documen -
CVE-2026-103634
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr
Same weakness: CWE-552
-
CVE-2026-76531
Files or Directories Accessible to External Parties in Splun -
CVE-2026-114400
Trudesk through 1.2.11 Missing Authentication for Ticket Att -
CVE-2026-112144
satya-vinay Events-Management-System project.sql file access -
CVE-2026-108070
Improper Access Control Allows Unauthorized Access to Protec -
CVE-2026-96857
Windows Projected File System Information Disclosure Vulnera
V. Comments for CVE-2023-50164
No comments yet