Apache Struts 2.3.19 to 2.3.20.2 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 when Dynamic Method Invocation is enabled allow remote attackers to execute arbitrary code via method: prefix related to chained expressions.