{"id":"CVE-2026-104711","published":"2026-10-05T19:17:14.497","lastModified":"2026-10-08T19:05:18.073","description":"Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-917"],"vendors":["apache"],"products":["struts"],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-075","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/10","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an attacker to inject malicious OGNL expressions, potentially leading to remote code execution. It matters because it can be exploited to gain full control over the affected application.","exploitability":"Exploitation is moderately hard as it requires crafting a specific request to inject an OGNL expression. The application must be configured to use the legacy RESTful action mapper and have the OGNL allowlist disabled.","blast_radius":"If exploited, this can result in complete compromise of the application, including data theft, unauthorized access, and potential lateral movement within the network.","remediation":"Upgrade to Apache Struts version 6.12.0 or 7.4.0, as these versions address the issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","struts","ognl"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:55.346Z"}}