PT-2026-1915 · Apache · Apache Struts

CVE-2025-68493 · Published 2025-12-19 · Updated 2026-08-03

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 6.1.0

Description An XML processing flaw exists in the XWork component of Apache Struts, specifically within the unconfigured SAX parser of the DomHelper class. The component fails to properly validate XML configuration, making it susceptible to XML External Entity (XXE) injection. This allows a remote attacker to use crafted XML to read sensitive local files and internal resources, trigger Server-Side Request Forgery (SSRF), or cause a Denial-of-Service (DoS) condition.

Recommendations Upgrade Apache Struts to version 6.1.1. As a temporary workaround, disable external entity processing via JVM properties or a custom SAXParserFactory. Restrict outbound egress traffic to minimize the risk of SSRF and data exfiltration.

Exploit

Fix

DoS

XXE

Weakness Enumeration

CWE-611

CWE-112

Related Identifiers

BDU:2026-00379

CVE-2025-68493

GHSA-QCFC-HMRC-59X7

Affected Products

Apache Struts

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68493.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68493 · Security Note
• https://bdu.fstec.ru/vul/2026-00379 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68493 · Vendor Advisory
• https://cwiki.apache.org/confluence/display/WW/S2-069 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcfc-hmrc-59x7 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://twitter.com/Bb1pKJl11k/status/2011052807336706494 · Twitter Post
• https://twitter.com/fofabot/status/2010633955897422227 · Twitter Post
• https://t.me/cveNotify/148373 · Telegram Post
• https://twitter.com/TheHackerWire/status/2010722936383320097 · Twitter Post
• https://twitter.com/zast_ai/status/2036237573727854807 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2012744304876306479 · Twitter Post
• https://twitter.com/geeknik/status/2010820378692551122 · Twitter Post
• https://twitter.com/taku888infinity/status/2011016102147768726 · Twitter Post