CVE-2021-31805: Apache Struts

Critical severity, CVSS 9.8. EPSS: 85.4% chance of exploitation in the next 30 days.

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Affected products

• Apache Struts: from 2.0.0, up to and including 2.5.29

Published 2022-04-12. Last modified 2026-06-17.