Apache Struts: OGNL injection in the legacy RESTful action mapper
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
CVE-2026-104711
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104711
Apache Struts
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Apache Software Foundation",
"product": "Apache Struts",
"versions": [
{
"status": "affected",
"version": "2.0.0",
"versionType": "semver",
"lessThanOrEqual": "2.3.37"
},
{
"status": "affected",
"version": "2.5.0",
"versionType": "semver",
"lessThanOrEqual": "2.5.33"
},
{
"status": "affected",
"version": "6.0.0",
"versionType": "semver",
"lessThanOrEqual": "6.11.0"
},
{
"status": "affected",
"version": "7.0.0",
"versionType": "semver",
"lessThanOrEqual": "7.3.0"
}
],
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"packageName": "org.apache.struts:struts2-core",
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104711
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #9306 · Revision 1
- Added to Heist Feed
- Publisher date