CVE-2017-5638

Apache Struts 2 has a flaw in how it handles file uploads that lets attackers run malicious commands on a server by sending specially crafted HTTP headers. This is a critical vulnerability that was actively exploited in real attacks.

The Jakarta Multipart parser in Apache Struts 2 (versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1) improperly handles exceptions during multipart form data processing, allowing remote code execution through OGNL injection via malicious Content-Type, Content-Disposition, or Content-Length headers. The vulnerability requires only network access to an affected application endpoint and no authentication, resulting in arbitrary command execution on the server.