CVE-2023-41835

—

CVSS 3.1

7.5 high

EPSS

6%p93

Published

Dec 5, 2023 (Dec 5, 2023)

Modified

Jun 17, 2026

Description

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Vendors: apache
Products: struts
Weakness: CWE-459
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (6.3%)

In the news0 stories

No ingested article mentions this CVE yet.