CVE-2023-50164 Coverage Advisory

This report details an attack chain exploiting CVE-2023-50164 in Apache Struts: an attacker crafts a multipart/form-data POST that uses mismatched parameter names and a path-traversal payload (via an "uploadFileName" field) to evade getCanonicalName checks, enabling upload of a malicious WAR/webshell to a target Tomcat webapps directory and resulting in remote code execution.