Loading story…
Apache Struts 2 contained a remote code execution flaw, CVE-2017-5638, in the Jakarta Multipart parser that allowed attackers to run arbitrary commands by sending crafted HTTP file-upload headers, including malicious Content-Type, Content-Disposition, or Content-Length values. The vulnerability affected Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1, and the CVE record notes that exploitation was observed in the wild, including attacks using a Content-Type header containing a #cmd= string.
The Apache Software Foundation highlighted CVE-2017-5638 as one of the notable exploitation-related cases in its annual security reporting, which summarized hundreds of vulnerability reports handled across more than 340 Apache projects. ASF said its 2020 security operations processed 18,000 security-related emails down to 946 non-spam threads, tracked 376 new vulnerability reports across 101 top-level projects, and assigned 151 CVE identifiers from 341 closed reports, underscoring both the scale of Apache’s disclosure workload and the continued significance of high-impact flaws such as the Struts RCE.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
The CVE record for Apache Struts vulnerability CVE-2017-5638 was updated by the Apache Software Foundation as CNA.
As of January 1, 2021, ASF said 35 of the 376 vulnerability reports it received during 2020 were still under triage, while the remaining closed reports had produced 151 CVE assignments.
In December 2020, ASF became the first organization to obtain a live CVE name using the CVE project's new automation API, shifting from pre-requested CVE pools to on-demand allocation.
In November 2020, the Apache Software Foundation released an internal tool to help projects edit, validate, and submit CVE entries to MITRE, aiming to reduce delays from legacy-format rejections.
ASF reported that CISA's Top 10 Routinely Exploited Vulnerabilities list in May 2020 included Apache Struts 2 remote code execution vulnerability CVE-2017-5638.
Apache Tomcat vulnerability CVE-2020-1938, known as Ghostcat, gained press attention in February 2020. The issue affected Tomcat installations exposing an unprotected AJP Connector to untrusted networks.
MITRE published the CVE record for CVE-2017-5638, documenting the Apache Struts Jakarta Multipart parser remote code execution flaw and affected versions.
Apache published a security advisory for the Struts Jakarta Multipart parser remote code execution flaw CVE-2017-5638 and said versions 2.3.32 and 2.5.10.1 or later were not vulnerable. The advisory recommended immediate upgrading or applying the documented workaround.
The CVE record states that Apache Struts remote code execution vulnerability CVE-2017-5638 was exploited in the wild in March 2017, including attacks using a crafted Content-Type header containing a #cmd= string.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcelists.apache.org
Open sources.apache.org
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Struts developers released fixes for **CVE-2024-53677**, a critical vulnerability in the framework's file upload handling that can allow malicious file upload and **remote code execution** in applications using `FileUploadInterceptor`. The flaw affects Struts versions `2.0.0` through `2.3.37`, `2.5.0` through `2.5.33`, and `6.0.0` through `6.3.0.2`, and has been assigned a **CVSS 4.0 score of 9.5**. Public proof-of-concept exploit code is available, and CSIRT.SK reported that the vulnerability is being actively exploited in the wild. Apache's guidance points organizations to **Struts 6.4.0 or later**, but the vendor's file upload documentation indicates remediation is not limited to patching alone: affected applications must also update source code to adopt the framework's newer file upload mechanism. Defenders are advised to review network and security logs for signs of compromise, as exposed internet-facing Struts applications that still rely on the legacy upload interceptor face elevated risk of exploitation.
Jul 24, 2026
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026
A high-severity vulnerability, tracked as CVE-2025-66675, has been identified in Apache Struts 2, affecting versions 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3. The flaw arises from a file leak in the multipart request processing component, which can lead to disk exhaustion and result in a denial-of-service (DoS) condition. Attackers can exploit this vulnerability remotely, potentially causing affected servers to crash by exhausting disk resources. The issue has been addressed in versions 6.8.0 and 7.1.1, and users are strongly advised to upgrade to these fixed versions to mitigate the risk. The vulnerability is related to improper handling of file uploads in multipart requests, which can allow attackers to trigger uncontrolled file creation or retention, leading to resource exhaustion. Security advisories recommend prompt patching, as the flaw is remotely exploitable and could be leveraged in automated attacks targeting exposed Struts 2 instances. No evidence of exploitation in the wild has been reported as of the latest updates, but the critical nature of the flaw warrants immediate attention from organizations using vulnerable versions.
Jun 29, 2026