-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | >= 2.0.0, < 6.8.0 | 6.8.0 |
| org.apache.struts:struts2-core | maven | >= 7.0.0, < 7.1.1 | 7.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2025-66675, is a Denial of Service in Apache Struts caused by a resource leak. When processing multipart/form-data requests, the JakartaMultiPartRequest class is used to handle file uploads and form fields. The underlying library, Apache Commons FileUpload, may create temporary files on disk for any part of the request, including regular form fields, if they exceed a certain size.
The vulnerability lies in the cleanUp() method of the org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest class. The original implementation only deleted temporary files associated with explicit file uploads, neglecting temporary files created for other form fields. This meant that with each specially crafted multipart request, temporary files were left behind on the server's disk.
A malicious actor could repeatedly send such requests, causing the disk to fill up, which would lead to a Denial of Service as the server would no longer be able to write files.
The patch addresses this by introducing a list, allFileItems, which tracks every single item processed from the multipart request inside the processUpload method. The cleanUp method was then rewritten to iterate over this comprehensive list, ensuring that every temporary file created during the request processing is properly deleted, thus plugging the leak.
org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest.cleanUpcore/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java
org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest.processUploadcore/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java