CVE-2024-53677: Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 72.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-11 · updated 2026-06-17
Weakness: CWE-434

Description

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

Affected products

Apache Struts: from 2.0.0 before 6.4.0 — fixed in 6.4.0

How to fix

Upgrade to a fixed version: Apache Struts 6.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53677 or the next vulnerability affects your stack