CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...

CVE-2026-38165

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:23+00:00| seen| https://t.me/GithubRedTeam/89404 2026-07-14 00:00:39+00:00| seen| https://t.me/GithubRedTeam/89404 2026-07-15 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/89404 2026-08-18 13:20:05+00:00| seen|...