high8.1
CVE-2025-68493
Apache Struts 2 is Missing XML Validation
Impact
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >= 2.0.0, <= 2.3.37 | none recorded |
| maven | com.opensymphony:xwork | >= 2.0.0, < 2.2.1 | none recorded |
| maven | org.apache.struts.xwork:xwork-core | >= 2.2.1, < 6.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | from 2.0.0 through 2.3.37 from 2.5.0 through 2.5.33 from 6.0.0 before 6.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cwiki.apache.org/confluence/display/WW/S2-069
- http://www.openwall.com/lists/oss-security/2026/01/11/2
- https://access.redhat.com/security/cve/CVE-2025-68493
- https://bugzilla.redhat.com/show_bug.cgi?id=2428559
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json
- https://github.com/advisories/GHSA-qcfc-hmrc-59x7
- https://nvd.nist.gov/vuln/detail/CVE-2025-68493