PT-2026-1915 · Apache · Apache Struts

Published 2025-12-19 · Updated 2026-03-24 · CVE-2025-68493

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 before 2.2.1 Apache Struts versions 2.2.1 through 6.1.0

Description The issue is a missing XML validation in Apache Struts, specifically within the XWork component. This allows for XML External Entity (XXE) injection attacks. An attacker can exploit this to read sensitive files, potentially trigger Server-Side Request Forgery (SSRF), or cause a denial-of-service. The flaw resides in the unconfigured SAX parser within DomHelper. Approximately 2.4 million instances have been identified. The vulnerability allows attackers to process external entities in crafted XML input.

Recommendations Upgrade to version 6.1.1 or later to resolve the issue. For deployments that cannot be immediately patched, disable external entity processing via a custom SAXParserFactory or JVM properties.

Fix

DoS

XXE

Weakness Enumeration

CWE-112

CWE-611

Related Identifiers

BDU:2026-00379

CVE-2025-68493

GHSA-QCFC-HMRC-59X7

Affected Products

Apache Struts

References · 43

• https://bdu.fstec.ru/vul/2026-00379 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68493 · Security Note
• https://osv.dev/vulnerability/GHSA-qcfc-hmrc-59x7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68493 · Vendor Advisory
• https://cwiki.apache.org/confluence/display/WW/S2-069 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://twitter.com/zast_ai/status/2036237573727854807 · Twitter Post
• https://twitter.com/zast_ai/status/2036230564508999891 · Twitter Post
• https://twitter.com/CCBalert/status/2011107888891036076 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2012744304876306479 · Twitter Post
• https://twitter.com/PortableAGI/status/2011072300637176038 · Twitter Post
• http://openwall.com/lists/oss-security/2026/01/11/2 · Note
• https://twitter.com/ThreatSynop/status/2010694838388154552 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1qbvv1k/top_10_trending_cves_13012026 · Reddit Post
• https://t.me/cveNotify/148421 · Telegram Post