CVE-2016-0785: Apache Struts RCE Vulnerability
Summary
CVE-2016-0785: Apache Struts RCE Vulnerability. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.0.0, < 2.3.20.3
>= 2.3.24, < 2.3.24.3
Fixed in 2.3.20.3 or 2.3.24.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The struts2-core package is a core component of Apache Struts, responsible for handling the core functionality of the framework. This package is widely used in various web applications.
Vulnerability Detail
The Apache Struts 2.x before 2.3.28 version is vulnerable to a remote code execution (RCE) vulnerability. This vulnerability allows remote attackers to execute arbitrary code by exploiting a %{} sequence in a tag attribute. This sequence triggers forced double OGNL (Object-Graph Navigation Language) evaluation, leading to the execution of arbitrary code. The impact of this vulnerability can be severe, as it allows attackers to gain unauthorized access to the affected system and potentially perform malicious activities.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.20.32.3.20.3 -
>= 2.3.24, < 2.3.24.32.3.24.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the usage of tag attributes that accept OGNL expressions. This can be achieved by modifying the application's configuration or code to restrict the usage of such attributes. For example, if the vulnerable attribute is 'exampleAttribute', it can be disabled by removing or commenting out the corresponding code that sets or uses this attribute.
Conclusion
The Apache Struts RCE vulnerability (CVE-2016-0785) is a critical security issue that allows remote code execution. It is crucial to upgrade the Apache Struts struts2-core package to the fixed version (2.3.28 or later) to mitigate the risk of exploitation. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
This vulnerability allows remote attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access and malicious activities.
To fix this vulnerability, it is recommended to upgrade the Apache Struts struts2-core package to version 2.3.28 or later.
Yes, a temporary workaround is to disable the usage of tag attributes that accept OGNL expressions.
You can find more information about this vulnerability in the Apache Struts advisory and the CVE entry (CVE-2016-0785).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
