CVE-2025-54656VulnerabilityPublished 30 Jul 2025Updated 4 Nov 2025

CVE-2025-54656: Apache Struts Extras · Log Injection

Affects Apache Struts ExtrasSource CVE Database V5

Not known to be exploited · CVSS 6.5 Medium · end of life, no fix coming : replace or isolate Apache Struts Extras; no fix will be released.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: None coming – the product is end of life

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 30 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

No fix will be released: Apache Struts Extras is end of life. Replace it, or isolate it from untrusted networks until you can.

Affected software

Product	Affected	Fixed in
Apache Software Foundation Apache Struts Extras	Affected =0	Fixed in–

AI-suggested

Given that Apache Struts Extras is a retired project with no forthcoming patches, the most effective mitigation is to migrate applications to supported and actively maintained frameworks that provide secure logging mechanisms. If immediate migration is not feasible, organizations should implement strict network segmentation and access controls to limit exposure of affected systems to trusted users only. Deploying Web Application Firewalls (WAFs) with custom rules to detect and block suspicious input patterns targeting LookupDispatchAction may provide temporary protection. Additionally, enhancing log monitoring to detect anomalies in log structure or unexpected log entries can help identify exploitation attempts. Organizations should also conduct thorough audits of existing logs to identify potential manipulation and improve incident response readiness. Finally, updating internal security policies to prohibit use of unsupported software and enforce timely patching and upgrades will reduce future risk.

Description

** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact

For European organizations, the primary impact of CVE-2025-54656 lies in the degradation of log integrity and reliability. Since logs are essential for detecting, analyzing, and responding to security incidents, manipulated logs can delay or misdirect incident response efforts, increasing the risk of undetected breaches or prolonged compromise. This is particularly critical for sectors with stringent compliance requirements such as finance, healthcare, and critical infrastructure, where accurate logging is mandated. The vulnerability does not directly expose sensitive data or disrupt service availability, but the indirect effects on security monitoring can lead to increased risk exposure. Organizations using legacy Apache Struts Extras components in production environments may face challenges in maintaining compliance with EU regulations like GDPR and NIS Directive due to compromised audit trails. Additionally, attackers could leverage this vulnerability to cover tracks after exploiting other weaknesses, complicating forensic investigations. The lack of vendor support exacerbates the risk, as no patches will be forthcoming, forcing organizations to rely on compensating controls or migration strategies.

Summary

CVE-2025-54656 is a vulnerability classified under CWE-117 (Improper Output Neutralization for Logs) found in Apache Struts Extras, specifically affecting versions prior to 2. The issue occurs when the LookupDispatchAction component logs untrusted input without proper sanitization or filtering. This improper handling allows specially crafted input to inject log entries that can masquerade as separate log lines, thereby corrupting the log structure. Such log injection can mislead automated log parsers or human analysts, potentially hiding malicious activity or causing confusion during incident investigations. The vulnerability does not directly compromise system confidentiality or availability but undermines the integrity and trustworthiness of log data, which is critical for security monitoring and forensic analysis. Notably, Apache Struts Extras is a retired project, and no official patches or updates will be provided to address this vulnerability. The CVSS score is 6.5 (medium severity), reflecting the ease of remote exploitation without authentication or user interaction, but limited impact scope. No known exploits are currently reported in the wild. Organizations still running this unsupported software face ongoing risk, especially if logs are relied upon for security operations. The recommended course of action is to migrate to supported frameworks or isolate and restrict access to affected instances to trusted users only.

CWE-117Improper Output Neutralization for Logs (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A09:2025: Security Logging & Alerting Failures (opens in a new tab)
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Logging (opens in a new tab)
Content Security Policy (opens in a new tab)
Application Logging Vocabulary (opens in a new tab)
OWASP ASVS 4.0.3
V7.3.1 (opens in a new tab)
V14.4.6 (opens in a new tab)
V14.4.4 (opens in a new tab)
Attack patterns
Audit Log Manipulation (opens in a new tab)
Web Server Logs Tampering (opens in a new tab)
Log Injection-Tampering-Forging (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2025, 22:07 UTC

WeaknessesCWE-117

Technical details

References

Community reviews

Related threats