Vulnerability Directory | CVE-2025-64775 | Struts

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.

‍

A Denial of Service vulnerability (CVE-2025-64775) has been identified in Apache Struts. This issue arises from a file leak during multipart request processing, which can lead to disk exhaustion and cause service disruption.

‍

Per OWASP, a Denial of Service (DoS) attack aims to make a system, application, or service unavailable for its intended use. DoS conditions can be triggered through overwhelming request volumes, exploitation of programming flaws, or improper handling of system resources, ultimately preventing legitimate users from accessing the service. In some cases, attackers may even inject or execute arbitrary code while carrying out a DoS attack, escalating the impact. These attacks can cause severe degradation in service quality, including long response delays, excessive failures, and complete service outages, resulting in a direct and significant impact on availability.

‍

This issue affects multiple versions of Apache Struts.

‍

Details

Module Info

Product: Apache Struts 2
Affected packages: struts2-core
Affected versions: >=2.0.0 <=2.3.37, >=2.5.0 <=2.5.33, >=6.0.0 <6.8.0, >=7.0.0 <7.1.1
GitHub repository: https://github.com/apache/struts
Package manager: Maven
Fixed in: NES for Apache Struts Struts 2 v2.5.38

‍

Vulnerability Info

CVE-2025-64775 is a Denial of Service vulnerability in Apache Struts caused by a file leak during multipart request processing. When triggered, the flaw can lead to uncontrolled disk usage, eventually exhausting system resources and disrupting service availability.

‍

Steps To Reproduce

This vulnerability can be reproduced by sending multipart requests where the file field includes a blank filename. In this scenario, the resulting FileItem is not properly tracked for cleanup, leaving temporary files on disk. A malicious attacker can repeatedly send these specially crafted requests, causing an unbounded accumulation of temporary files and eventually exhausting the destination drive.

Proof Of Concept

To reproduce this issue, download the Apache Struts source code and check out a vulnerable version, such as the 2.5.33 branch. Build the example applications, then deploy and run the Struts Showcase application; using Docker with Tomcat 9 is a simple approach. Once the showcase WAR is running, navigate to the application’s “File → Multiple File Upload” page. Create a file whose name consists of a single space character and upload it. After the upload completes, inspect the server’s filesystem. For example, by running docker exec struts2-apps ls /usr/local/tomcat/work/Catalina/localhost/showcase/. You will observe temporary files such as upload_b264d026_d7f9_479b_8929_9100fead694a_00000001.tmp remain on disk, demonstrating the leak and confirming the vulnerability.

‍