Apache Struts is vulnerable to improper neutralization of Expression Language (OGNL) statements when the legacy RESTful action mapper is used. An attacker can craft a request that injects an OGNL expression, allowing execution of arbitrary code on the server. This can compromise confidentiality, integrity, and availability of the affected application, potentially giving full system control to the attacker. This is a CWE-917 (Expression Language Injection) vulnerability.

Apache Software Foundation’s Struts framework, specifically versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3. The vulnerability applies only when the legacy RESTful action mapper is enabled; applications using the default mapper, restful2 mapper, or the Struts REST plugin are not affected.

The vulnerability carries a high exploitation risk because an attacker can deliver the payload via a normal HTTP request to the exposed REST endpoint. No credentials are required, and the vector is network-based. The CVSS score is 9.8, and the EPSS score is < 1%. The lack of mitigation in affected versions makes exploitation straightforward. The issue is not currently listed in CISA KEV, but the potential for remote code execution warrants immediate attention.