GHSA-8c6j-ffmf-q6vm CVE-2016-3081
Apache Struts RCE Vulnerability
High
Known exploited
Maven
- Severity
- 8.1 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 96.53%
- Chance of exploitation in the next 30 days. Higher than 99.88% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Oct 8, 2026
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Fix
2.3.20.3- Upgrade org.apache.struts:struts2-core to this version or later
Exploited in the wild. Apache Struts Command Injection Vulnerability (Apache Struts). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Oct 11, 2026.
Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.struts:struts2-core | >= 2.3.19, < 2.3.20.3 |
2.3.20.3 |
| org.apache.struts:struts2-core | >= 2.3.21, < 2.3.24.3 |
2.3.24.3 |
| org.apache.struts:struts2-core | >= 2.3.25, < 2.3.28.1 |
2.3.28.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.struts:struts2-core Maven → 2.3.20.3
- maven
<dependency><groupId>org.apache.struts</groupId><artifactId>struts2-core</artifactId><version>2.3.20.3</version></dependency>- gradle
implementation("org.apache.struts:struts2-core:2.3.20.3")
Severity breakdown
CVSS 3.0 8.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
How to prevent it
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
References
Advisories
Packages
Other links
- struts.apache.org/docs/s2-032.html
- web.archive.org/web/20210123152457/http://www.securityfocus.com/bid/91787
- web.archive.org/web/20210225192113/http://www.securityfocus.com/bid/87327
- web.archive.org/web/20210226011418/http://www.securitytracker.com/id/1035665
- exploit-db.com/exploits/39756
- packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-C…
- huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
Timeline
- Published
- Last updated by the source
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-47qp-8v9g-39hp Code injection in Apache Struts | Critical Known exploited | Also affects org.apache.struts:struts2-core |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution | Critical Known exploited | Also affects org.apache.struts:struts2-core |
| CVE-2020-17530 Remote code execution in Apache Struts | Critical Known exploited | Also affects org.apache.struts:struts2-core |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation | Critical Known exploited | Also affects org.apache.struts:struts2-core |
| CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation | High Known exploited | Also affects org.apache.struts:struts2-core |
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation | High | Also affects org.apache.struts:struts2-core |
| GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability | High | Also affects org.apache.struts:struts2-core |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak | High | Also affects org.apache.struts:struts2-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor