Critical Severity
CVE-2026-104711
Published: Nov 12, 2026
POC exploit for CVE-2026-104711 - OGNL injection RCE in Apache Struts legacy REST action mapper (S2-075). Vulnerable vs fixed verification included.
# CVE-2026-104711 — Apache Struts OGNL injection (S2-075)
Improper neutralization of an OGNL expression in the legacy RESTful action
mapper (S2-075, CWE-917). When an application configures
`org.apache.struts2.dispatcher.mapper.RestfulActionMapper`, the action name is
taken verbatim from the first URI path segment. Unlike `DefaultActionMapper`,
the legacy mapper never applied the allowed action-name pattern, so a request
whose first path segment contains an OGNL expression passes it unchanged into
downstream consumers that evaluate OGNL, leading to remote code execution.
Fixed in Struts 6.12.0 and 7.4.0 (the mapper now routes non-conforming names to
a configurable default action name, exactly like `DefaultActionMapper` has done
since the S2-057/S2-061 hardening). NVD scores 9.8 (AC:L); the vendor scores
8.1 because the legacy mapper must be explicitly configured (AC:H).
## Meta
- Affected: Struts 2.0.0 - 2.3.37, 2.5.0 - 2.5.33, 6.0.0 - 6.11.0, 7.0.0 - 7.3.0
- Fixed: 6.12.0 (6.x line), 7.4.0 (7.x line)
- CVSS v3.1: 9.8 critical (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, NVD); vendor-scored 8.1
- Advisory: https://cwiki.apache.org/confluence/display/WW/S2-075
- GHSA: https://github.com/advisories/GHSA-wfm5-pq4p-gff9
- oss-security: http://www.openwall.com/lists/oss-security/2026/10/05/10
- Not affected: default action mapper, `restful2` mapper, Struts REST plugin; Struts 7 default config (OGNL allowlist enabled)
## Usage
Build and start both lab instances (vulnerable 6.11.0 and patched 6.12.0
control, identical application conf