OGNL (Object-Graph Navigation Language) is a Java expression language used by Apache Struts to read and set object properties, call methods, and evaluate dynamic expressions. It is powerful for building flexible web applications, but it becomes risky when attacker-controlled input is fed into expression evaluation.
In a Struts application, OGNL is often used behind tags, action mapping, and data binding. If an application allows untrusted text to reach an OGNL context, an attacker may try expression injection to access unexpected objects or execute dangerous methods, which can lead to remote code execution or data exposure. Defenders reduce this risk by upgrading Struts, avoiding deprecated or legacy request paths, limiting dynamic evaluation, and validating or rejecting input before it reaches framework internals. In practice, OGNL is not the problem by itself; the danger comes from trusting user input inside a language designed to be executable.