CVE-2023-50164

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

• CWE-552

• http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhjMailing List, Patch
• https://security.netapp.com/advisory/ntap-20231214-0010/Third Party Advisory, VDB Entry
• https://www.openwall.com/lists/oss-security/2023/12/07/1Mailing List
• http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhjMailing List, Patch
• https://security.netapp.com/advisory/ntap-20231214-0010/Third Party Advisory, VDB Entry
• https://www.openwall.com/lists/oss-security/2023/12/07/1Mailing List

Published

Dec 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5014A vulnerability was found in Sakshi2610 Food Ordering Websit…9.8
• CVE-2023-50147There is an arbitrary command execution vulnerability in the…9.8
• CVE-2023-5015A vulnerability was found in UCMS 1.4.7. It has been classif…6.1
• CVE-2023-50159In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mod…8.8
• CVE-2023-5016A vulnerability was found in spider-flow up to 0.5.0. It has…9.8
• CVE-2023-50162SQL injection vulnerability in EmpireCMS v7.5, allows remote…7.2
• CVE-2023-50165Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected…8.6
• CVE-2023-50166Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issu…6.1
• CVE-2023-50167Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS iss…6.1
• CVE-2023-50168Pega Platform from 6.x to 8.8.4 is affected by an XXE issue …7.7
• CVE-2023-5017A vulnerability was found in lmxcms up to 1.41. It has been …9.8
• CVE-2023-50170Rejected reason: This is unused.