CVE-2026-104711
Received Received - Intake

Expression Language Injection in Apache Struts

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Apache Software Foundation

Description
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104711
EUVD
EUVD-2026-92622

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Struts 2.0.0
Apache Software Foundation Apache Struts 2.5.0
Apache Software Foundation Apache Struts 6.0.0
Apache Software Foundation Apache Struts 7.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-917 The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Expression Language Injection vulnerability in Apache Struts. It allows attackers to inject OGNL expressions through a crafted request when the legacy RESTful action mapper is used. This can lead to remote code execution. The issue only affects Struts 7 if the OGNL allowlist is disabled, which is not the default setting.

Detection Guidance

To detect this vulnerability, check if your Apache Struts version falls within the affected ranges (2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.11.0, 7.0.0-7.3.0). Verify if the legacy RESTful action mapper is enabled and the OGNL allowlist is disabled. Inspect server logs for suspicious OGNL expression patterns or unexpected remote code execution attempts.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server running the vulnerable Struts application. This could lead to data theft, system compromise, or disruption of services. Systems using the default action mapper or restful2 mapper are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations must address it to maintain compliance and avoid potential fines or legal consequences.

Mitigation Strategies

Immediately upgrade to Apache Struts 6.12.0 or 7.4.0. Alternatively, switch to the default action mapper, restful2 mapper, or Struts REST plugin if using the legacy RESTful action mapper. Ensure the OGNL allowlist is enabled by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart