Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Struts

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104711 Public exploit

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OG…

    Apache Software Foundation Apache Struts
  • Critical 9.5
    CVE-2024-53677 Public exploit EPSS 72%

    Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

    File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affec…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2023-50164 Public exploit EPSS 81%

    Apache Struts: File upload component had a directory traversal vulnerability

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2021-31805 Public exploit EPSS 85%

    Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

    The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-12611 Public exploit EPSS 87%

    Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal

    In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2017-9791 Exploited Public exploit EPSS 99%

    Code execution in Apache Struts 1 plugin

    The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-struts1-plugin Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021