CVE-2009-1275: Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (...

Security readout for executives and security teams

CVE-2009-1275 is a legacy Apache Tiles issue where some JSP tags could evaluate Expression Language twice. In affected applications, that behavior may let a remote attacker cause cross-site scripting or expose sensitive information. The source bundle does not provide CVSS, severity, or specific attack vectors. Exposure is most likely in legacy Java web applications that package Apache Tiles 2.1 before 2.1.2, directly or through Struts or another framework. The bundle does not identify exact CPEs, affected downstream versions, or vulnerable configurations beyond the two JSP tags. Treat this as a legacy exposure cleanup item unless vulnerable Tiles is found in an internet-facing or sensitive application. If present, remediation should be scheduled promptly because the impact includes XSS and possible data exposure, but the bundle provides no active exploitation evidence. Mitigation focus: Inventory applications using Apache Tiles or Struts-era Tiles integrations.; Upgrade Apache Tiles 2.1 deployments to 2.1.2 or later where applicable.; Check Apache Tiles and Struts guidance for affected downstream packaging..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.