Apache Struts 2: RestfulActionMapper OGNL Injection Unauthenticated Root RCE

Apache Struts 2 6.11.0 suffers unauthenticated root RCE because RestfulActionMapper never adopted the post-S2-057 cleanupActionName sanitization, enabling OGNL injection through a wildcard {1} into result-location evaluation, combined with a novel java.beans internal-reflection sandbox bypass.