A legacy RESTful action mapper is an older Apache Struts routing mechanism that translates incoming HTTP requests into controller actions using older URL and method conventions. Instead of treating every request the same way, it can change how paths, parameters, and verbs are interpreted before the application code runs.
This matters because routing is part of the trust boundary. If a deprecated mapper is still enabled, it may widen the attack surface by exposing alternate request-handling paths that developers no longer review carefully. In poorly constrained setups, attackers can use those paths to reach unexpected actions, trigger unsafe expression handling, or bypass assumptions about which requests are valid. Defenders should inventory whether the legacy mapper is active, remove it when possible, upgrade the framework, and test for unintended endpoints. Strong allowlists, strict parameter validation, and route restrictions help reduce the risk.