CVE-2016-3081
High · 8.1 CISA KEVCVSS
8.1
EPSS
96.1%
Published
Apr 26, 2016
CISA due date
Oct 11, 2026
The record
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.3.19 | 2.3.20.3 |
| Maven | org.apache.struts:struts2-core | 2.3.21 | 2.3.24.3 |
| Maven | org.apache.struts:struts2-core | 2.3.25 | 2.3.28.1 |
| maven | org.apache.struts/struts2-core | 2.3.19 | No fix |
| maven | org.apache.struts/struts2-core | 2.3.21 | No fix |
| maven | org.apache.struts/struts2-core | 2.3.25 | No fix |
Related vulnerabilities
- GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation Also affects org.apache.struts:struts2-core
- CVE-2025-68493 Missing XML Validation vulnerability in Apache Struts, Apache Struts. Also affects org.apache.struts:struts2-core
- GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- CVE-2025-66675 Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2025-64775 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2024-53677 Apache Struts file upload logic is flawed Also affects org.apache.struts:struts2-core
- CVE-2012-1592 A local code execution issue exists in Apache Struts2 when processing malformed XSLT… Also affects org.apache.struts:struts2-core