Vulnerability GHSA-729q-fcgp-r5xh
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
2 years ago
December 05, 2023 at 09:33 AM UTC
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0
Summary
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
Details
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 months ago
Apache Struts 2 is Missing XML Validation
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
High Risk
10 months ago
Apache Struts has a Denial of Service vulnerability
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
High Risk
10 months ago
Apache Struts is Vulnerable to DoS via File Leak
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
Critical
1 year ago
Apache Struts file upload logic is flawed
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
Critical
2 years ago
Apache Struts vulnerable to path traversal
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
Impacted packages
Timeline
Published
2 years ago
December 05, 2023 at 09:33 AM UTC
Fixed (6.3.0.1)
Unknown
Unknown
Fixed (6.1.2.2)
Unknown
Unknown
Fixed (2.5.32)
Unknown
Unknown
Last Modified
11 months ago
November 04, 2025 at 10:17 PM UTC