Floci VTL Template Injection Remote Code Execution

Floci versions 1.1.0 and later before version 2.2.0 contain a code injection vulnerability in VtlTemplateEngine that allows unauthenticated command execution through unrestricted Velocity mapping templates. https://packetstorm.news/download/236045...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci versions 1.1.0 before 2.2.0 are vulnerable to a code injection flaw in the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute OS commands within the Floci JVM by creating a REST API with a MOCK integration . Attackers can leverage unrestricted Veloci...

CVE-2026-108598: Improper Control of Generation of Code

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: conductor, wso2is, akhq, apicurio-registry, airbyte-server, opensearch, apache-hop, jbang, trino, conductor-fips, opensearch-fips, nacos-docker, geoserver, pinot-fips, airbyte-platform, logstash-fips, airbyte-server-fips, floci-az, hadoop-fips, nrjmx,...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: conductor, wso2is, akhq, apicurio-registry, airbyte-server, opensearch, apache-hop, jbang, trino, conductor-fips, opensearch-fips, nacos-docker, geoserver, pinot-fips, airbyte-platform, logstash-fips, airbyte-server-fips, floci-az, hadoop-fips, nrjmx,...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: apicurio-registry, request-9047-keycloak-fips, apicurio-registry-fips, hono, keycloak-fips, floci-az...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: apicurio-registry, request-9047-keycloak-fips, apicurio-registry-fips, hono, keycloak-fips, floci-az...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: commercial-elasticsearch, conductor, akhq, kafka-bridge, apicurio-registry, airbyte-server, opensearch, apache-hop, apache-pulsar, celeborn, conductor-fips, infinispan, opensearch-fips, pinot-fips, airbyte-server-fips, hadoop-fips, keycloak, apache-nifi,...

CVE-2026-55851 vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-hop, apache-pulsar, celeborn, pinot-fips, hadoop-fips, floci-az, keycloak, apache-hop-fips, knative-kafka-broker-fips, knative-kafka-broker, apache-pulsar-fips, tinkerpop, zipkin, apache-activemq-artemis, thingsboard,...

GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-hop, apache-pulsar, celeborn, pinot-fips, hadoop-fips, floci-az, keycloak, apache-hop-fips, knative-kafka-broker-fips, knative-kafka-broker, apache-pulsar-fips, tinkerpop, zipkin, apache-activemq-artemis, thingsboard,...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-hop, apache-pulsar, celeborn, pinot-fips, hadoop-fips, floci-az, keycloak, apache-hop-fips, knative-kafka-broker-fips, knative-kafka-broker, apache-pulsar-fips, tinkerpop, zipkin, apache-activemq-artemis, thingsboard,...

CVE-2026-59919 vulnerabilities

Vulnerabilities for packages: apicurio-registry, apache-hop, apache-pulsar, celeborn, pinot-fips, hadoop-fips, floci-az, keycloak, apache-hop-fips, knative-kafka-broker-fips, knative-kafka-broker, apache-pulsar-fips, tinkerpop, zipkin, apache-activemq-artemis, thingsboard,...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: conductor, apicurio-registry, airbyte-server, apache-hop, conductor-fips, nacos-docker, geoserver, airbyte-server-fips, keycloak, nacos, flyway-fips, apache-hop-fips, flyway, camunda, debezium, druid, camunda-zeebe, thingsboard, apicurio-registry-fips, floci,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: conductor, apicurio-registry, airbyte-server, apache-hop, conductor-fips, nacos-docker, geoserver, airbyte-server-fips, keycloak, nacos, flyway-fips, apache-hop-fips, flyway, camunda, debezium, druid, camunda-zeebe, thingsboard, apicurio-registry-fips, floci,...