---
id: "CVE-2012-0391"
kind: "vulnerability"
aliases: ["CVE-2012-0391"]
title: "Apache Struts 2: Apache Struts 2 Improper Input Validation Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.75599
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Struts 2", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "package", "self-hosted", "struts2"]
not_affected_if: ["struts-not-used", "version-2.2.3.1-or-later"]
published_at: "2012-01-08T15:55:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-0391", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-0391", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0391", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Struts 2: Apache Struts 2 Improper Input Validation Vulnerability

Apache Struts 2 before 2.2.3.1 has an input validation flaw in its ExceptionDelegator component. A remote attacker can send crafted input to execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Struts 2 affected ? fixed ?

## Fix

Upgrade Apache Struts 2 to 2.2.3.1 or later, per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-0391
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2012-0391
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2012-0391

## From the sources

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_