Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Remote Code Execution (RCE) vulnerability (CVE-2025-48734) has been identified in the BeanUtils dependency of Struts 1. This vulnerability allows attackers to execute arbitrary commands on affected servers by injecting malicious input into RESTful API endpoints, exploiting improper input sanitization mechanisms.
Per the Open Web Application Security Project (OWASP): "Code Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization."
This issue affects multiple versions of Apache Struts before and including 1.3.10.
Details
Module Info
- Product: Apache Struts 1
- Affected packages: struts-core, commons-beanutils
- Affected versions:
- Apache Struts: <=1.3.10
- Apache Commons Beanutils: >=1.0 <1.11, >=2.0.0-M1 <2.0.0-M2
- GitHub repository: https://github.com/apache/struts1
- Package manager: Maven
- Published packages:
- Fixed in: NES for Struts Struts 1
Vulnerability Info
Similar to CVE-2014-0114, CVE-2025-48734 accesses the class loader via declaredClass on all java enum objects.
Mitigation
Struts 1 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Struts.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Raj (mailto:denesh.raj@zohocorp.com) who reported
- Muthukumar Marikani (mailto:muthukumar.marikani@zohocorp.com) who found
