OGNL injection is a vulnerability where attacker-controlled data reaches an Object-Graph Navigation Language evaluation point. OGNL is used in some Java frameworks to read and write object properties, call methods, and compute values dynamically. If input is not strictly separated from code, the application may interpret hostile text as part of an expression instead of as plain data.
This matters because expression evaluation can cross from simple data handling into powerful runtime behavior, including file access, object manipulation, or even code execution. In real attacks, OGNL injection often appears in request parameters, headers, path variables, or message fields that are passed into framework helpers, tag libraries, or routing logic. Defenses include avoiding dynamic evaluation of untrusted input, using allowlists and strict expression contexts, disabling risky framework features when possible, and keeping framework components patched. Secure configuration is especially important in legacy web applications that rely on template or action-mapping systems.