Log in Start free

Vulnerability · Published Jan 11, 2026 · Assigned by apache

CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

High 8.1

In plain English

A high-severity XML external entity in Apache Struts from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 50.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)50.4%top 1.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavencom.opensymphony:xworkno fix listedGHSA-qcfc-hmrc-59x7
Mavenorg.apache.struts.xwork:xwork-coreno fix listedGHSA-qcfc-hmrc-59x7
Mavenorg.apache.struts:struts2-coreno fix listedGHSA-qcfc-hmrc-59x7
Mavenorg.apache.struts:struts2-coreno fix listedGHSA-qcfc-hmrc-59x7
Mavenorg.apache.struts:struts2-core6.1.1GHSA-qcfc-hmrc-59x7

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Struts 2.0.0 – before 2.2.1
Apache Software Foundation Apache Struts 2.2.1 – through 6.1.0

Weakness: CWE-611, CWE-112 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References