CVE-2025-68493: Apache Struts 2 XML Validation Vulnerability
Summary
CVE-2025-68493: Apache Struts 2 is Missing XML Validation. Affects org.apache.struts:struts2-core across 3 version ranges.
>= 2.0.0, <= 2.3.37
>= 2.5.0, <= 2.5.33
>= 6.0.0, < 6.1.1
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts 2 is a popular open-source framework for building web applications in Java. It provides a robust architecture for developing enterprise-level applications, enabling developers to create dynamic web content with ease. However, certain versions of Apache Struts 2 are vulnerable to a Missing XML Validation issue, which can lead to severe security risks if not addressed.
Vulnerability Detail
The Missing XML Validation vulnerability in Apache Struts 2 arises from the framework's failure to properly validate XML input. This oversight can allow attackers to exploit the application by injecting malicious XML data, potentially leading to unauthorized access, data manipulation, or denial of service. The vulnerability affects versions from 2.0.0 to 6.1.0, making it critical for users to be aware of their current version and the associated risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation on their XML data before processing it with Apache Struts. This can help mitigate the risk of malicious XML injection until an upgrade can be performed.
Conclusion
The Missing XML Validation vulnerability in Apache Struts 2 poses significant risks to applications using affected versions. It is crucial for users to upgrade to version 6.1.1 or later to ensure their applications are secure. Implementing input validation can serve as a temporary measure until an upgrade is feasible.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
The vulnerability affects Apache Struts versions from 2.0.0 to 6.1.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, Vulert can help identify if your application is affected by this vulnerability.
Yes, implementing input validation on XML data can serve as a temporary workaround to reduce the risk of exploitation.
Detailed information about this vulnerability can be found in the advisory database on GitHub and other security resources.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
