Description
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | < 2.3.20.3 | 2.3.20.3 | GHSA-pvm9-288c-v5wq |
| Maven | org.apache.struts:struts2-core | >= 2.3.24, < 2.3.24.3 | 2.3.24.3 | GHSA-pvm9-288c-v5wq |
| Maven | org.apache.struts:struts2-core | >= 2.3.28, < 2.3.28.1 | 2.3.28.1 | GHSA-pvm9-288c-v5wq |
Advisories 1
- WID-SEC-2026-3852 Apache Struts: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Oct 11, 2026
References
- 88826 vdb-entry
- http://struts.apache.org/docs/s2-031.html
- 1035664 vdb-entry