Tag

#file-upload

2 posts tagged #file-upload.

Analysis · Jun 18, 2026 · Colten Anderson

Two Struts CVEs, one incomplete fix, and the enterprise Java visibility problem

CVE-2023-50164 and CVE-2024-53677 hit the same file upload component in Apache Struts, a year apart. The second arrived because the fix for the first didn't go far enough. The real exposure is organizations that don't know where Struts lives in their stack.
Analysis · May 5, 2026 · Colten Anderson

SmarterMail fixed a CVSS 10 and told no one for two months

CVE-2025-52691 is a pre-auth RCE in SmarterMail's file upload API. SmarterTools patched it silently in October 2025 with no CVE, no advisory, and release notes that said 'critical security fixes.' watchTowr found the silent fix two months later. Here's why that matters.