-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 6.4.0 | 6.4.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the legacy FileUploadInterceptor and its associated multipart request handling. The advisory explicitly states that applications using FileUploadInterceptor are vulnerable, while the newer ActionFileUploadInterceptor (introduced in 6.4.0) is safe. The FileUploadInterceptor's intercept method is responsible for processing upload parameters, and the JakartaMultiPartRequest's parse method handles raw file upload data. Both fail to adequately sanitize user-supplied filenames, allowing path traversal. Confidence is high for FileUploadInterceptor due to direct advisory references, and medium for JakartaMultiPartRequest due to its role in the deprecated upload mechanism.
org.apache.struts2.interceptor.FileUploadInterceptor.interceptorg/apache/struts2/interceptor/FileUploadInterceptor.java
org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest.parseorg/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java