Exploit for #VU83960 Path traversal in Apache Struts

Vulnerability identifier: #VU83960

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2023-50164

CWE-ID: CWE-22

Exploitation vector: Network

Exploits in database: 7

• March 18, 2025
  • CVE-2023-50164-ApacheStruts2-Docker (Vulnerable docker container for Apache Struts 2 RCE CVE-2023-50164) [Github]
• March 14, 2025
  • cve-2023-50164-poc (Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164")) [Github]
• October 11, 2024
  • CVE-2023-50164-PoC (CVE-2023-50164 PoC Application & Exploit script) [Github]
• June 14, 2024
  • cve-2023-50164-poc (Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164")) [Github]
• June 7, 2024
  • CVE-2023-50164-Apache-Struts-RCE (A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and r [Github]
• January 15, 2024
  • Trackplus Allegra Service Desk Module UploadHelper upload Directory Traversal Remote Code Execution Vulnerability [Source Incite]
• December 15, 2023
  • Apache Struts2 文件上传漏洞分析（CVE-2023-50164） [Custom exploits]

Vulnerable software:
Apache Struts
Server applications / Frameworks for developing and running applications

Vendor: Apache Foundation