CVE-2025-68493

Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Affected

Apache Software Foundation · Apache Struts

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CVSS v3.1 CNA

7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

EPSS

45.85% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-611

Published

2026-01-11

Updated

2026-09-14

Proof-of-concept exploits (1)

• hsltz/CVE-2025-684932★ · 2026-02-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68493.yaml

Exploit collections (1)

• CVE-2025-68493.yamlzan8in/afrog

Security advisories

• https://cwiki.apache.org/confluence/display/WW/S2-069
• http://www.openwall.com/lists/oss-security/2026/01/11/2
• advisories/GHSA-qcfc-hmrc-59x7

References

• CVE Record
• NVD entry