Description
Apache Struts是一个基于MVC设计模式的、广泛使用的开源Java Web应用程序框架。其底层XWork组件在处理XML配置文件时存在一处缺失验证的漏洞，该组件未对XML输入进行充分的验证和过滤。攻击者可以通过构造包含恶意外部实体引用的XML配置数据，触发XML外部实体注入攻击，从而读取服务器上的敏感文件、发起服务器端请求伪造（SSRF）或导致拒绝服务。建议受影响用户立即升级至Apache Struts 6.1.1版本以修复此问题。
Apache Struts XWork组件 XML外部实体注入漏洞（CVE-2025-68493）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-68493
https://cwiki.apache.org/confluence/display/WW/S2-069
https://zhuanlan.zhihu.com/p/1995087662713955440
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/middleware/Apache-Struts-S2-069-XML-%E5%A4%96%E9%83%A8%E5%AE%9E%E4%BD%93%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E-CVE-2025-68493.md
https://cloud.tencent.com/developer/article/2651928
https://nsfocusglobal.com/apache-struts-external-entity-xxe-injection-vulnerability-s2-069-cve-2025-68493/
https://www.cve.org/CVERecord?id=CVE-2025-68493
https://access.redhat.com/security/cve/cve-2025-68493
https://www.herodevs.com/blog-posts/cve-2025-68493-why-this-apache-struts-vulnerability-is-a-bigger-warning-sign