description: In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
problem types: Possible path traversal in the Convention plugin
affected:
{
product: Apache Struts
vendor: Apache Software Foundation
versions:
status: affected, version: 2.3.x before 2.3.31
status: affected, version: 2.5.x before 2.5.5
}