CVE-2006-1546
Apache Struts vulnerable to Improper Input Validation
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
Exploit likelihood
What each source reports
NVD Score used
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
- Record
CVE-2006-1546- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
- Record
CVE-2006-1546- Updated
- 2026-11-02
EUVDEUVD-2022-5348 No score
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
- Record
EUVD-2022-5348- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vf8g-mpmw-qv87
Apache Struts vulnerable to Improper Input Validation
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
- Record
GHSA-vf8g-mpmw-qv87- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-vf8g-mpmw-qv87
Apache Struts vulnerable to Improper Input Validation
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
- Record
GHSA-vf8g-mpmw-qv87- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
struts:strutsMaven |
before 1.2.9 | 1.2.9 |
struts:strutsMaven |
before 1.2.9, plus listed versions 1.0.21.11.1-b2-200211241.1-b31.1-beta-2 Show 6 moreShow less1.1-rc11.1-rc21.2.21.2.41.2.71.2.8 |
1.2.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1546 is a high vulnerability (CVSS 7.5) in Apache Struts, published March 30, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.29%, the 93rd percentile. Fixed in struts:struts 1.2.9.
References
mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%3c20060121221800.15814.qmail%40web32607.mail.mud.yahoo.com%3e
securitytracker.com/id?1015856
struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
vupen.com/english/advisories/2006/1205
securityfocus.com/bid/17342
issues.apache.org/bugzilla/show_bug.cgi?id=38374
Show 10 moreShow less
secunia.com/advisories/19493
exchange.xforce.ibmcloud.com/vulnerabilities/25612
lists.suse.com/archive/suse-security-announce/2006-May/0004.html
nvd.nist.gov/vuln/detail/CVE-2006-1546
github.com/advisories/GHSA-vf8g-mpmw-qv87