CVE-2026-104711

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104711
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104711.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104711
Published
2026-10-05T18:35:10Z
Modified
2026-10-10T02:47:26Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Struts: OGNL injection in the legacy RESTful action mapper
Details

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.

Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-917"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104711.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.3.37"
                },
                {
                    "introduced": "2.5.0"
                },
                {
                    "last_affected": "2.5.33"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.11.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.3.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5
Last Affected
60a1a2642ae7ddf74c0062fe37b3b57f83a0588e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ca8d57c538136983a0180ac508ebcfabaf73f839
Introduced
68fb49c10e083dce829476778eec726fc90c8c38
Fixed
07aea27ba59aa8c4d9fda05bfeec3bf80f2a0473
Introduced
1d95543fbf2c873d5dab1773f951c38e3220b4e5
Fixed
7ba6ef01a9215e8ce6ce5a9e82f5b418714f2920
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.3.37"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "last_affected": "2.5.33"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.12.0"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other
STRUTS_2_3_24
STRUTS_2_3_24_1
STRUTS_2_3_25
STRUTS_2_3_26
STRUTS_2_3_27
STRUTS_2_3_28
STRUTS_2_3_29
STRUTS_2_3_30
STRUTS_2_3_31
STRUTS_2_3_32
STRUTS_2_3_33
STRUTS_2_3_34
STRUTS_2_3_35
STRUTS_2_3_36
STRUTS_2_3_37
STRUTS_2_5_10
STRUTS_2_5_11
STRUTS_2_5_12
STRUTS_2_5_13
STRUTS_2_5_14
STRUTS_2_5_14_1
STRUTS_2_5_15
STRUTS_2_5_16
STRUTS_2_5_17
STRUTS_2_5_18
STRUTS_2_5_19
STRUTS_2_5_20
STRUTS_2_5_21
STRUTS_2_5_22
STRUTS_2_5_23
STRUTS_2_5_24
STRUTS_2_5_25
STRUTS_2_5_26
STRUTS_2_5_27
STRUTS_2_5_28
STRUTS_2_5_28_1
STRUTS_2_5_28_2
STRUTS_2_5_28_3
STRUTS_2_5_29
STRUTS_2_5_3
STRUTS_2_5_30
STRUTS_2_5_31
STRUTS_2_5_32
STRUTS_2_5_33
STRUTS_2_5_4
STRUTS_2_5_5
STRUTS_2_5_6
STRUTS_2_5_7
STRUTS_2_5_8
STRUTS_2_5_9
STRUTS_2_5_BETA1
STRUTS_2_5_BETA2
STRUTS_6_0_0
STRUTS_6_0_1
STRUTS_6_0_2
STRUTS_6_0_3
STRUTS_6_1_0
STRUTS_6_1_1
STRUTS_6_2_0
STRUTS_6_3_0
STRUTS_6_3_0_1
STRUTS_6_4_0
STRUTS_6_5_0
STRUTS_6_6_0
STRUTS_6_6_1
STRUTS_6_7_0
STRUTS_6_7_1
STRUTS_6_7_2
STRUTS_6_7_3
STRUTS_6_7_4
STRUTS_6_8_0
STRUTS_7_0_0
STRUTS_7_0_1
STRUTS_7_0_2
STRUTS_7_0_3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104711.json"