Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tiles/tiles-core@2.1.2
purl pkg:maven/org.apache.tiles/tiles-core@2.1.2
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-jjre-tuhb-4yat
Aliases:
CVE-2023-49735
GHSA-qw4h-3xjj-84cc
Apache Tiles: Unvalidated input may lead to path traversal and XXE The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. There are no reported fixed by versions.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-eury-mu1z-w3bp Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags. CVE-2009-1275
GHSA-2c6q-rgvj-66rx

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T22:44:32.811030+00:00 GitLab Importer Affected by VCID-jjre-tuhb-4yat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2023-49735.yml 38.4.0
2026-04-16T21:46:17.068750+00:00 GitLab Importer Fixing VCID-eury-mu1z-w3bp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2009-1275.yml 38.4.0
2026-04-12T00:04:09.024075+00:00 GitLab Importer Affected by VCID-jjre-tuhb-4yat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2023-49735.yml 38.3.0
2026-04-11T23:02:03.081423+00:00 GitLab Importer Fixing VCID-eury-mu1z-w3bp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2009-1275.yml 38.3.0
2026-04-03T00:08:49.502666+00:00 GitLab Importer Affected by VCID-jjre-tuhb-4yat https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2023-49735.yml 38.1.0
2026-04-02T23:10:31.006715+00:00 GitLab Importer Fixing VCID-eury-mu1z-w3bp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2009-1275.yml 38.1.0
2026-04-01T16:00:37.626939+00:00 GHSA Importer Fixing VCID-eury-mu1z-w3bp https://github.com/advisories/GHSA-2c6q-rgvj-66rx 38.0.0
2026-04-01T13:09:15.138525+00:00 GithubOSV Importer Fixing VCID-eury-mu1z-w3bp https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2c6q-rgvj-66rx/GHSA-2c6q-rgvj-66rx.json 38.0.0
2026-04-01T12:49:59.944624+00:00 GitLab Importer Fixing VCID-eury-mu1z-w3bp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tiles/tiles-core/CVE-2009-1275.yml 38.0.0