Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113730— OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Quick assessment

Affected
orphan-oss ognl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OGNL 是一个用于 Java 的对象图导航库。在 3.4.13 版本之前，OgnlRuntime.invokeMethod 中的可选“严格调用模式”（stricter-invocation mode）会检查 OGNL 所调用方法的声明类，但并未阻止 java.lang.reflect.Method、java.lang.reflect.Constructor 或 java.lang.reflect.Field。攻击者可控的表达式可以利用这些反射对象作为被阻断类上方法的代理，从而在 JDK 反射内部执行真实操作，再次

CVSS 5.6 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113730

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
Source: CVE Program / CVE List V5
Vulnerability Description
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
orphan-oss ognl < 3.4.13 -

II. Public POCs for CVE-2026-113730

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113730

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-113730 (3)

Vendor Advisories for CVE-2026-113730 (1)

IV. Related Vulnerabilities

Same weakness: CWE-693

V. Comments for CVE-2026-113730

No comments yet

Leave a comment