CVE-2016-3081 Apache Struts Command Injection

What is CVE-2016-3081?

CVE-2016-3081 is a high-severity code injection vulnerability in Apache Struts, published on 26 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Weakness: CWE-77

Which versions are affected by CVE-2016-3081?

6 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 20 products.

Products include Apache Struts, Huawei Agile Controller-Campus Firmware, Huawei Anyoffice, Huawei Firehunter6000 Firmware, Huawei Logcenter, Huawei Oceanstor 18500 V3 Firmware and 14 more.

How do I fix CVE-2016-3081?

Upgrade org.apache.struts:struts2-core to a fixed version for your release line: 2.3.20.3, 2.3.24.3 or 2.3.28.1. US federal agencies must fix it by 11 Oct 2026.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-3081 being exploited?

Yes. Attackers have exploited CVE-2016-3081 in the wild since at least 8 Oct 2026.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Other vulnerabilities in Apache Struts

• CVE-2020-17530 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2017-9791 Apache Struts 1 Improper Input Validation Exploited Critical 9.8
• CVE-2017-5638 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2012-0391 Apache Struts 2 Improper Input Validation Exploited Critical 9.8
• CVE-2018-11776 Apache Struts Remote Code Execution Exploited High 8.1

All Apache Struts vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8c6j-ffmf-q6vm.