CVE-2021-31805: Expression Language Injection in Apache Struts
Summary
CVE-2021-31805: Expression Language Injection in Apache Struts. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.5.30. Fixed in 2.5.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The struts2-core package is a core component of Apache Struts, responsible for handling requests and managing the application flow. This package is widely used in various Maven-based Java projects. However, versions 2.0.0 to 2.5.29 of struts2-core are vulnerable to an Expression Language Injection vulnerability.
Vulnerability Detail
The vulnerability (CVE-2021-31805) in Apache Struts arises from an incomplete fix for a previous vulnerability (CVE-2020-17530). Certain tag attributes in the affected versions can undergo double evaluation if a developer applies forced OGNL (Object-Graph Navigation Language) evaluation using the %{...} syntax. This can lead to remote code execution and a degradation of security. Exploiting this vulnerability allows an attacker to execute arbitrary code on the server, potentially compromising the entire application and its underlying infrastructure.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.30
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using forced OGNL evaluation on untrusted user input. Instead, they should validate and sanitize the input before using it in tag attributes. This can be achieved by implementing input validation and output encoding techniques, such as using OWASP Java Encoder library or Struts built-in mechanisms like the s:property tag.
Conclusion
The Expression Language Injection vulnerability in Apache Struts (CVE-2021-31805) poses a critical risk to applications using versions 2.0.0 to 2.5.29 of the struts2-core package. It is crucial to upgrade to version 2.5.30 or later to mitigate this vulnerability. Additionally, developers should implement input validation and output encoding techniques to prevent injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architecture.
Exploiting this vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the server. This can result in a complete compromise of the application and its underlying infrastructure.
Versions 2.0.0 to 2.5.29 of the struts2-core package are affected by this vulnerability.
To fix this vulnerability, upgrade the Apache Struts struts2-core package to version 2.5.30 or later. Additionally, validate and sanitize any user input used in tag attributes to prevent injection attacks.
As a temporary workaround, avoid using forced OGNL evaluation on untrusted user input. Implement input validation and output encoding techniques to sanitize the input before using it in tag attributes.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
