Child pages
  • S2-031
Skip to end of metadata
Go to start of metadata


XSLTResult can be used to parse arbitrary stylesheet

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution

Maximum security rating



Always validate type and content of uploaded files, do not expose them directly in your web application. Alternatively upgrade to Struts, Struts or Struts

Affected Software

Struts 2.0.0 - Struts Struts 2.3.28 (except and


GENXOR - genxors at gmail dot com - Qihoo 360 SkyEye Lab

CVE Identifier



XSLTResult allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely executable code.


Always validate type and content of uploaded files. We encourage you to upgrade to one of the versions of the Apache Struts presented above.

Backward compatibility

No issues expected when upgrading to Struts, and


Implement your own XSLTResult based on code of the recommended versions. 

  • No labels