Two vulnerabilities have been identified in Apache Struts, which could be exploited by attackers to bypass security restrictions or gain knowledge of sensitive information.
The first issue is caused by input validation errors in "FilterDispatcher" and "DefaultStaticContentLoader" when processing user-supplied requests, which could allow attackers to traverse the directory structure and download files outside the "static" content folder, using double-encoded urls and relative paths.
The second vulnerability is caused by an error in XWork, which could allow a malicious user to bypass the "#"-usage protection built into the ParametersInterceptor and manipulate server side context objects.
