Apache Struts CVE-2025-66675

Exploitation requires the target application to process multipart/form-data requests (Struts file-upload/multipart handling, which is active by default in the framework's request dispatcher); an attacker sends repeated crafted multipart requests that leak temporary files via incomplete cleanup until the disk fills. No authentication or user interaction is required (PR:N/UI:N). Limiting factors: the application must actually route multipart requests through Struts, the attacker needs sustained request volume to exhaust storage, and impact is bounded to availability (service disruption), not code execution or data compromise.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a remotely reachable, unauthenticated, low-complexity flaw, and the A:H component reflects a genuine availability impact (disk exhaustion that can take a service offline). However, several signals temper the raw 8.2 score: EPSS is only 0.59% (47th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data - so there is no evidence of active or imminent exploitation. The CVSS vector also asserts C:L, which is difficult to reconcile with a CWE-459 (incomplete cleanup) disk-exhaustion issue described purely as a Denial of Service and file leak; the confidentiality claim is not substantiated by the description and should be verified with the vendor (see assessed vector below, where I score C:N). Net: a real, patch-worthy availability defect in a widely deployed framework, but currently a 'high-CVSS, moderate-real-risk' issue rather than an emergency - prioritize behind any Struts RCE-class flaws.

A remote, unauthenticated attacker repeatedly submits crafted multipart/form-data requests to a Struts-based web application. Because temporary files from multipart processing are not properly cleaned up, each request leaves residual files that accumulate on disk until the filesystem is exhausted, crashing or hanging the application. No public exploit code was identified, but the low attack complexity makes a simple scripted request flood sufficient.