Posted by Daniel Owens via Fulldisclosure on Nov 01Description Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code execution via Object-Graph Navigation Language (OGNL) through several different mechanisms but only in a cursory fashion -- the libraries only guard against immediate calls evaluated by the OGNL engine via `SecurityMemberAccess`, but an allowed call that, instead, accepts nested arguments and, itself, invokes reflection internally executes outside of the...

YouTube video by Northern Disclosure

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.

Posted by Lukasz Lenart on Oct 05 Severity: moderate Affected versions: - Apache Struts 2.0.0 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0 Description: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted...

TL;DR The Apache Struts team has fixed four Apache Struts vulnerabilities in Struts 7.4.0 and 6.12.0. The most serious, CVE-2026-104711, allows OGNL injection that may lead to remote code execution in apps using the legacy RESTful action mapper. The other three cause denial of service or leak data between users. Why It Matters These Apache Struts vulnerabilities matter because Struts still runs many long-lived Java web applications.

YouTube video by Maestro Charlez

An ahead-of-time MyBatis: mappers and SQL are compiled into plain Java at build time — no proxies, no reflection, no OGNL at runtime.

YouTube video by Canal 10 Santos FC - com Alex Frutuoso

YouTube video by Northern Disclosure

YouTube video by Guard The Leaf

Posted by Arnout Engelen on Aug 18 Severity: moderate Affected versions: - Apache Commons OGNL: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related...

YouTube video by Desmascarando

YouTube video by Guard The Leaf

Introduction: Apache Struts2’s OGNL (Object-Graph Navigation Language) expressions, when mishandled, can lead to remote code execution (RCE) and severe security breaches. A recent proof-of-concept (PoC) demonstrates how attackers manipulate `DefaultActionMapper` to redirect victims to malicious domains. This article dissects the exploit, provides mitigation techniques, and equips security professionals with actionable commands. Learning Objectives: Understand how OGNL injection works in Apache Struts2.

Security updates have been issued by Debian (ffmpeg, jetty12, jetty9, jq, and pam), Fedora (curl, libssh, podman-tui, and prometheus-podman-exporter), Oracle (firefox, gnutls, kernel, and thunderbird), and SUSE (bluez, cairo, chromium, cmake, cups, firefox, frr, govulncheck-vulndb, kernel, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, mariadb, mybatis, ognl, python-h2, and rke2).