# Krampus delivers an end-of-year Struts vulnerability

DevFeed: [Krampus delivers an end-of-year Struts vulnerability](<https://devfeed.tech/articles/krampus-delivers-an-end-of-year-struts-vulnerability-8194.md>)

Original publisher: [Read original article](<https://snyk.io/blog/struts-path-traversal-vulnerability/>)

Author: Micah Silverman

Published: 2024-01-02T06:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Library](<https://devfeed.tech/topics/library.md>), [Java](<https://devfeed.tech/topics/java.md>), [Maven](<https://devfeed.tech/topics/maven.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [acquisition](<https://devfeed.tech/tags/acquisition.md>), [apache](<https://devfeed.tech/tags/apache.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [blog](<https://devfeed.tech/tags/blog.md>), [breach](<https://devfeed.tech/tags/breach.md>), [code](<https://devfeed.tech/tags/code.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [github](<https://devfeed.tech/tags/github.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [java](<https://devfeed.tech/tags/java.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-cloud](<https://devfeed.tech/tags/snyk-cloud.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [update](<https://devfeed.tech/tags/update.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article explains CVE-2023-50164, a critical path traversal vulnerability in Apache Struts. It describes the risk of remote code execution, demonstrates a proof-of-concept exploit, and recommends upgrading Struts to 2.5.33 or 6.3.0.2 or later.

## Source excerpt

CVE-2023-50164 is a critical vulnerability in the Apache Struts library. Learn how to find and fix by upgrading your package and using Snyk to discover and remediate.