CVE-2016-3082: Remote Code Execution in Apache Struts
Summary
CVE-2016-3082: Remote Code Execution in Apache Struts. Affects org.apache.struts:struts2-core across 3 version ranges.
< 2.3.20.3
>= 2.3.24, < 2.3.24.3
>= 2.3.28, < 2.3.28.1
Fixed in 2.3.20.3, 2.3.24.3 or 2.3.28.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The Apache Struts struts2-core package is a core component of the framework. It is widely used in various web applications.
Vulnerability Detail
The vulnerability with CVE-2016-3082, also known as GHSA-pvm9-288c-v5wq, allows for remote code execution in Apache Struts. The XSLTResult feature of the framework allows the location of a stylesheet to be passed as a request parameter. In certain circumstances, this can be exploited to inject remotely executable code. An attacker could craft a malicious request that includes a specially crafted stylesheet parameter, leading to the execution of arbitrary code on the server. This vulnerability has a CVSSv3 severity score of 9.8 (Critical).
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.20.32.3.20.3 -
>= 2.3.24, < 2.3.24.32.3.24.3 -
>= 2.3.28, < 2.3.28.12.3.28.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable the XSLTResult feature in the Apache Struts configuration. This can be done by modifying the struts.xml configuration file and removing or commenting out the XSLTResult configuration. However, this workaround may impact the functionality of the application, and it is strongly recommended to upgrade to a fixed version as soon as possible.
Conclusion
The vulnerability CVE-2016-3082 in Apache Struts allows for remote code execution, posing a significant risk to applications using the affected versions of the struts2-core package. It is crucial to upgrade to a fixed version (2.3.20.3, 2.3.24.3, or 2.3.28.1) to mitigate the risk. Secure coding practices and input validation should also be followed to prevent code injection vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
This vulnerability allows for remote code execution in Apache Struts. An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, it is recommended to upgrade the Apache Struts struts2-core package to a version that includes the fix. The fixed versions are 2.3.20.3, 2.3.24.3, and 2.3.28.1. Update your application's dependencies to use one of these versions.
If upgrading to a fixed version is not immediately feasible, you can disable the XSLTResult feature in the Apache Struts configuration. However, this may impact the functionality of your application, and it is strongly recommended to upgrade to a fixed version as soon as possible.
This vulnerability has a CVSSv3 severity score of 9.8 (Critical), indicating a high level of risk and potential impact.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
