7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64775

CVE-2025-64775: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64775

CVE-2025-64775:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.struts:struts2-core	maven	>= 6.0.0, < 6.8.0	6.8.0
org.apache.struts:struts2-core	maven	>= 7.0.0, < 7.1.1	7.1.1
org.apache.struts:struts2-core	maven	>= 2.0.0, <= 2.3.37
org.apache.struts:struts2-core	maven	>= 2.5.0, <= 2.5.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) caused by a resource leak in Apache Struts' multipart request handling. When processing a multipart/form-data request, the underlying commons-fileupload library may create temporary files on disk for any of the parts, including regular form fields, not just file uploads. The vulnerability lies in the cleanUp method of the org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest class. The original implementation only cleaned up temporary files associated with actual file uploads, completely ignoring the temporary files created for other form fields. This allowed an attacker to send a series of multipart requests containing form fields that would be written to disk, exhausting the available disk space and causing a DoS. The patch addresses this by introducing a list, allFileItems, to track every single FileItem created during the request processing in the processUpload method. The cleanUp method was then rewritten to iterate through this comprehensive list, ensuring that all temporary files, regardless of whether they are from a file upload or a form field, are properly deleted. The primary vulnerable function is cleanUp due to its incomplete logic, and parse is the entry point that triggers the vulnerable process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.