GitHub Advisoryadvisory · Maven

GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation

HIGH Published 2026-01-11 Modified 2026-01-16 Official page ↗
Aliases
CVE-2025-68493
Ecosystem
Maven
Packages
org.apache.struts:struts2-core, com.opensymphony:xwork, org.apache.struts.xwork:xwork-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weaknesses
CWE-112, CWE-611
Reviewed
2026-01-13

Affected packages

• Maven org.apache.struts:struts2-core: >= 2.0.0, <= 2.3.37 (no fix yet) • Maven org.apache.struts:struts2-core: >= 2.5.0, <= 2.5.33 (no fix yet) • Maven org.apache.struts:struts2-core: >= 6.0.0, < 6.1.1 → fixed in 6.1.1 • Maven com.opensymphony:xwork: < 2.2.1 (no fix yet) • Maven org.apache.struts.xwork:xwork-core: < 6.1.1 (no fix yet)

Description

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-68493 Missing XML Validation vulnerability in Apache Struts, Apache Struts. vulnerability

Weakness · CWE (2)

  • CWE-112 Missing XML Validation weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References