PatchTheCVECVE-2020-26259: XStream is a Java library to serialize objects to XML and back again
CVE-2020-26259 is a medium-severity flaw (CVSS 6.8) affecting struts, xstream, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, yo
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 82.4% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-12-16 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-26259?
struts: upgrade to 6.0.0; xstream: upgrade to 1.4.15; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-26259 being exploited?
CVE-2020-26259 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-26259 affect?
CVE-2020-26259 affects struts, xstream, debian linux. Severity is medium (CVSS 6.8). XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delet
How urgent is CVE-2020-26259?
Priority 64/100. EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Apache Struts vulnerabilities · Java vulnerabilities · Debian vulnerabilities
Related CVEs
- CVE-2025-66675 HIGH 8.2 UPGRADE Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaus
- CVE-2026-104714 HIGH 8.8 UPGRADE Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in A
- CVE-2026-104713 MEDIUM 6.5 UPGRADE Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
- CVE-2026-104712 HIGH 7.5 UPGRADE Asymmetric resource consumption (amplification) vulnerability in Apache Struts
- CVE-2026-104711 CRITICAL 9.8 UPGRADE Improper neutralization of special elements used in an expression language statement ('Expression Language Inj