Critical Apache Struts 2 Vulnerability Allow Attackers to Steal Sensitive Data

Cybersecurity: Apache Struts 2 Vulnerability Update

A critical XML External Entity (XXE) injection vulnerability, identified as CVE-2025-68493, has been found in Apache Struts 2. This vulnerability could potentially expose numerous applications to data theft and server compromise.

The security flaw is located in the XWork component of Apache Struts 2, which manages XML configuration parsing. This component's failure to properly validate XML input allows for XXE injection attacks.

CVE ID Vulnerability Type Affected Component Affected Versions

CVE-2025-68493 XML External Entity (XXE) Injection XWork Component Struts 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.1.0

This vulnerability has been rated as "Important" due to its potential impact on data confidentiality and system availability. It affects a broad range of Struts 2 versions currently utilized by organizations worldwide.

Affected Version Range Status

Struts 2.0.0 – 2.3.37 End-of-Life

Struts 2.5.0 – 2.5.33 End-of-Life

Struts 6.0.0 – 6.1.0 Active Support

Organizations using these versions should prioritize security updates immediately. Successful exploitation of CVE-2025-68493 could lead to:

Impact Type Description

Data Disclosure Attackers can extract sensitive configuration files, database credentials, and application secrets

Server-Side Request Forgery (SSRF) Internal network resources and systems can be compromised

Denial of Service (DoS) Application availability can be disrupted using malicious XML payloads

Apache has released Struts 6.1.1 as the fixed version. Organizations are advised to upgrade to this release immediately. The patch maintains backward compatibility, ensuring seamless deployment without affecting existing applications.

Organizations unable to upgrade immediately can implement temporary workarounds:

Mitigation Approach Description

Custom SAXParserFactory Configure a custom SAXParserFactory by setting xwork.saxParserFactory to a factory class that disables external entities

JVM-Level Configuration Disable external entities globally using JVM system properties: -Djavax.xml.accessExternalDTD="" , -Djavax.xml.accessExternalSchema="" , -Djavax.xml.accessExternalStylesheet=""

These workarounds offer temporary protection while organizations plan their upgrade timelines. Immediate patching should be prioritized, followed by verifying that workarounds are in place for systems that cannot be upgraded immediately. Organizations should review their Struts 2 inventory and develop an expedited patching schedule to mitigate exposure to this critical vulnerability.

Based on reporting by Cyber Security News.