CVE-2026-104711: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') in Apache Software Foundation Apache Struts

This vulnerability involves improper neutralization of special elements in expression language statements within Apache Struts. When configured with the legacy RESTful action mapper, an attacker can inject malicious OGNL expressions via crafted requests, potentially enabling remote code execution. The vulnerability affects multiple version ranges: 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Struts 7 versions are only vulnerable if the OGNL allowlist is disabled, which is off by default. Other action mappers such as the default, restful2, or the Struts REST plugin are not impacted. The issue is fixed in versions 6.12.0 and 7.4.0.

Successful exploitation can lead to remote code execution on affected Apache Struts servers configured with the legacy RESTful action mapper and without the OGNL allowlist enabled. This could allow attackers to execute arbitrary code remotely, potentially compromising the affected system. However, applications using default or other REST mappers are not impacted, and Struts 7 is only vulnerable if the OGNL allowlist is disabled.

Users should upgrade affected Apache Struts versions to 6.12.0 or 7.4.0, where this vulnerability is fixed. Additionally, for Struts 7 users, ensure the OGNL allowlist is enabled (the default setting) to mitigate the risk. Applications using the default action mapper, restful2 mapper, or Struts REST plugin are not affected and require no action related to this vulnerability.