Dynamic Method Invocation is an Apache Struts feature that lets an incoming request choose which action method gets called instead of always using the default handler. It was meant as a convenience, but it also expands the request surface and makes method dispatch depend more heavily on user-controlled input.
In cyber security, DMI matters because unsafe or legacy configurations can turn a routine web request into a path toward unintended code paths, and in some vulnerable Struts releases even remote code execution. Attackers look for enabled DMI, especially request patterns such as method:, while defenders reduce risk by disabling DMI, upgrading off affected versions, restricting allowed methods, and reviewing logs for suspicious dispatch syntax.