CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.12.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.4.0 - Configuration
Enable the OGNL allowlist; Struts 7 is affected only when it is disabled.
Apache Struts OGNL allowlist = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications configured to use the legacy RESTful action mapper are exposed within the affected version ranges. Struts 7 deployments are affected only if the OGNL allowlist has been disabled; the allowlist is enabled by default.
Are applications using other Struts request-mapping options affected?
No. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected by this issue.
What does an attacker need to exploit the vulnerability?
An attacker needs to send a crafted request to an application using the legacy RESTful action mapper. The request can inject an OGNL expression, which may result in remote code execution.
What versions remediate the issue?
Upgrade to Apache Struts version 6.12.0 or 7.4.0, which fix the issue.