Description
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 - 2.3.33, 2.5 - 2.5.10.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution EDB-44556 · remote · Sep 8, 2017 · verified
GitHub 3 repositories
-
brianwrf/S2-053-CVE-2017-12611 ★ 37 · Sep 8, 2017
A simple script for exploit RCE for Struts 2 S2-053(CVE-2017-12611)
-
zeynepsilao/CVE-2017-12611_Exploit ★ 0 · Sep 24, 2025
RCE project
-
tcetin704/CVE-2017-12611 ★ 0 · Sep 15, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Struts2 S2-053 - Remote Code Execution http/cves/2017/CVE-2017-12611.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.1, < 2.3.34 | 2.3.34 | GHSA-8fx9-5hx8-crhm |
| Maven | org.apache.struts:struts2-core | >= 2.5.0, < 2.5.11 | 2.5.11 | GHSA-8fx9-5hx8-crhm |