Vulnerability GHSA-qcfc-hmrc-59x7
High Risk
HIGH RISK
CVSS Score: 8.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
9 months ago
January 11, 2026 at 03:31 PM UTC
Apache Struts 2 is Missing XML Validation
2.0.4 - 2.1.3
2.0.4 - 2.1.3
Summary
Apache Struts 2 is Missing XML Validation
Details
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
10 months ago
Apache Struts has a Denial of Service vulnerability
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
High Risk
10 months ago
Apache Struts is Vulnerable to DoS via File Leak
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
Critical
1 year ago
Apache Struts file upload logic is flawed
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
Critical
2 years ago
Apache Struts vulnerable to path traversal
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
High Risk
2 years ago
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
Impacted packages
Timeline
Published
9 months ago
January 11, 2026 at 03:31 PM UTC
Fixed (6.1.1)
Unknown
Unknown
Last Modified
8 months ago
February 03, 2026 at 03:17 AM UTC