The XML Trap: Critical Struts 2 Flaw CVE-2025-68493 Exposes Data

A new vulnerability in Apache Struts 2, tracked as CVE-2025-68493, targets the XWork component and could allow attackers to steal data or launch Denial-of-Service attacks by exploiting improper handling of XML configurations and XML External Entity injection. According to The Apache Struts team, the flaw arises from a failure to validate XML in the parsing of configurations, creating a pathway for remote exploitation when processing tainted XML files.

The issue could lead to disclosure of data, denial of service, or server-side request forgery, with a potentially wide blast radius across many Struts versions, including Struts 2.0.0 through 2.3.37 (EOL), 2.5.0 through 2.5.33 (EOL), and 6.0.0 through 6.1.0. The recommended fix is to upgrade to Struts 6.1.1 at least, a change described as backward compatible.

For those unable to upgrade immediately, workarounds include using a custom SAXParserFactory that disables external entities or configuring JVM options to block external DTD and Schema access.