CVE-2023-50164: Apache Struts file upload path traversal leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS indicate severe risk of remote code execution.

What it is

Apache Struts allows an attacker to manipulate file upload parameters, enabling path traversal that can place a malicious file on the server. Under some circumstances this leads to remote code execution. The flaw is critical because it is remotely reachable without authentication and can result in full server compromise.

Impact

An attacker can write files outside the intended upload directory and, in some configurations, execute arbitrary code on the server. This gives full control over the affected application and host.

Attack surface

Reachable over the network via HTTP requests to file upload functionality; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.808, 99.6th percentile) and public exploit references exist, indicating active interest and likely weaponization.

What to do

• Upgrade to Struts 2.5.33 or Struts 6.3.0.2 or later immediately.
• If immediate upgrade is not possible, restrict or disable file upload endpoints and validate/normalize upload paths.
• Run the application with least privilege and isolate it from sensitive internal systems.
• Monitor for and block traversal sequences in upload parameters at the WAF or reverse proxy.
• Review server directories for unexpected uploaded files and remove any found.

Detection

• Inspect HTTP requests for path traversal sequences (../, encoded variants) in file upload parameters.
• Monitor file system for new files written outside expected upload directories.
• Alert on unexpected process execution or child processes spawned by the web server.
• Review web server and application logs for anomalous upload requests and 200 responses to suspicious paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.