Apache issues patches for critical Struts 2 RCE bug

CVE-2024-53677 is a high-severity remote code execution vulnerability in Apache Struts that allows attackers to manipulate file upload parameters to achieve path traversal and potentially upload malicious files leading to RCE. Apache advises upgrading to Struts 6.4.0+ (which removes the deprecated File Upload Interceptor) because there is no workaround; affected versions include Struts 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.3.0.2. The report highlights strong CVSS scores (9.5–9.8), the widespread usage of Struts, and historical impact of Struts vulnerabilities (e.g., the Equifax incident), underscoring significant risk until systems are patched.