Critical XXE Vulnerability in Apache Struts 2 (CVE-2025-68493)

A critical XML External Entity (XXE) injection vulnerability, tracked as CVE-2025-68493, has been identified in the XWork component of Apache Struts 2. This flaw allows attackers to exploit improper XML input validation, potentially leading to sensitive data disclosure, server-side request forgery (SSRF), and denial-of-service (DoS) attacks. The vulnerability affects a wide range of Struts 2 versions, including 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.1.0, exposing millions of applications to risk. Security researchers at ZAST.AI reported the issue, and Apache has rated the vulnerability as 'Important' due to its significant impact on data confidentiality and system availability.

Organizations using affected versions are strongly advised to upgrade to Struts 6.1.1, which addresses the vulnerability. The issue is remotely exploitable and has been assigned a CVSS 3.1 score of 8.1 (High). Immediate patching is recommended to prevent exploitation, as attackers can leverage this flaw to extract configuration files, database credentials, and other sensitive information from vulnerable servers. The vulnerability has been confirmed by both independent security researchers and the Apache security team.