{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.1","last_affected":"1.2.9"}],"component":"struts:struts","cve_ids":["CVE-2023-49735"],"ecosystem":"Maven","epss":0.01356,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qw4h-3xjj-84cc","id":"tcs_01M5N9ACHEWGH05M51ZKX7ETS4","modified_at":"2025-11-04T18:44:12.388014Z","published_at":"2023-12-01T00:31:00Z","references":["https://osv.dev/vulnerability/GHSA-qw4h-3xjj-84cc","https://nvd.nist.gov/vuln/detail/CVE-2023-49735","https://github.com/apache/tiles","https://lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-qw4h-3xjj-84cc#Maven/struts:struts","url":"https://osv.dev/vulnerability/GHSA-qw4h-3xjj-84cc"}],"summary":"Apache Tiles: Unvalidated input may lead to path traversal and XXE"}