CVE-2016-6795

—

CVSS 3.0

9.8 critical

EPSS

8%p95

Published

Sep 20, 2017 (Sep 20, 2017)

Modified

Jun 17, 2026

Description

In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.

Vendors: apache
Products: struts
Weakness: CWE-22
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.2%)

In the news0 stories

No ingested article mentions this CVE yet.