CVE-2006-1546: Apache Struts Improper Input Validation
Summary
CVE-2006-1546: Apache Struts vulnerable to Improper Input Validation. Affects struts:struts versions < 1.2.9. Fixed in 1.2.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications. However, prior to version 1.2.9, Apache Struts is vulnerable to an Improper Input Validation issue. This vulnerability allows remote attackers to bypass validation by sending a request with a specific parameter, leading to potential security breaches in applications that do not use the isCancelled check.
Vulnerability Detail
The vulnerability in Apache Struts arises from a flaw in the validation process. By including a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter in a request, an attacker can cancel the action without detection in applications that do not utilize the isCancelled check. This can lead to unauthorized access, data manipulation, or other malicious activities. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.3.
How To Fix
Latest published version: 1.2.9 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Apache Struts is not immediately feasible, a temporary workaround is to manually implement the isCancelled check in the affected applications. By explicitly checking for the 'org.apache.struts.taglib.html.Constants.CANCEL' parameter and canceling the action if present, the vulnerability can be mitigated. Here is an example of how to implement the workaround in Java:
if (request.getParameter("org.apache.struts.taglib.html.Constants.CANCEL") != null) {
// Cancel the action
}
Conclusion
In conclusion, Apache Struts versions prior to 1.2.9 are vulnerable to an Improper Input Validation issue. This vulnerability can be mitigated by upgrading to the latest version of Apache Struts and ensuring the correct implementation of the isCancelled check. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for struts:struts →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications.
This vulnerability allows remote attackers to bypass validation in Apache Struts, potentially leading to unauthorized access, data manipulation, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade Apache Struts to version 1.2.9 or later. Developers should also ensure that the isCancelled check is implemented correctly in their applications.
Yes, a temporary workaround is to manually implement the isCancelled check in the affected applications. By checking for the 'org.apache.struts.taglib.html.Constants.CANCEL' parameter and canceling the action if present, the vulnerability can be mitigated.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.3.
Related vulnerabilities
Recent vulnerabilities recorded for struts:struts.
