Page History

...

In both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker.

Solution

Do not use such constructions in your code or use read-only properties to initialise the value attribute (property with getter only).  Upgrade You can upgrade to Apache Struts version 2.5.12 or 2.3.34 which contain more restricted Freemarker configuration but removing vulnerable constructions is preferable.

Backward compatibility

No backward incompatibility issues are expected.

...