QwikSec

Security Database

CVE

CWE

Training

CVE-2023-41835

Published: Dec 5, 2023

Modified: Nov 4, 2025

PUBLISHED

Description

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	affected `2.0.0 - <= 2.5.31` affected `6.1.2.1 - <= 6.3.0`

Weaknesses (CWE)

References

https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft

mailing-list

vendor-advisory

https://www.openwall.com/lists/oss-security/2023/12/09/1

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.