Apache Struts is an open-source Java web framework used to build Model-View-Controller (MVC) applications. It helps route requests, process form input, render views, and integrate features such as REST handling and message formatting. Because it often sits deep inside enterprise web stacks, Struts can shape a large part of an application’s attack surface.
In cyber security, Struts matters because bugs in its action mappers, plugins, type conversion, or expression handling can lead to remote code execution, injection, denial of service, or information leakage. Attackers often target exposed framework components rather than the application code itself, especially when legacy modules remain enabled. Defenders should patch quickly, inventory which Struts features are actually in use, remove unused plugins, and limit request size and input paths where possible.