CVE-2025-68493

CVE-2025-68493: Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Vendor Apache Software Foundation
Product Apache Struts
Weakness CWE-611 · XXE
Published January 11, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Key dates

02Disclosure timeline

January 11, 2026 CVE published
June 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload CVE-2024-50442 WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8 CVE-2025-32138 WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability