Floci VTL Template Injection Remote Code Execution

Floci versions 1.1.0 and later before version 2.2.0 contain a code injection vulnerability in VtlTemplateEngine that allows unauthenticated command execution through unrestricted Velocity mapping templates. https://packetstorm.news/download/236045...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci versions 1.1.0 before 2.2.0 are vulnerable to a code injection flaw in the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute OS commands within the Floci JVM by creating a REST API with a MOCK integration . Attackers can leverage unrestricted Veloci...

CVE-2026-108598: Improper Control of Generation of Code

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: geoserver, apache-hop, conductor-fips, logstash, zaproxy, elasticsearch-fips, apicurio-registry-fips, hadoop-fips, dependency-track-apiserver, druid, airbyte-platform-fips, conductor, wso2is, akhq, airbyte-server, nrjmx, jmeter, elasticsearch, trino, apache-hop-fips,...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: geoserver, apache-hop, conductor-fips, logstash, zaproxy, elasticsearch-fips, apicurio-registry-fips, hadoop-fips, dependency-track-apiserver, druid, airbyte-platform-fips, conductor, wso2is, akhq, airbyte-server, nrjmx, jmeter, elasticsearch, trino, apache-hop-fips,...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: floci-az, apicurio-registry-fips, keycloak-fips, apicurio-registry, request-9047-keycloak-fips, hono...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: floci-az, apicurio-registry-fips, keycloak-fips, apicurio-registry, request-9047-keycloak-fips, hono...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator-fips, camunda, infinispan, commercial-elasticsearch, apache-hop, conductor-fips, kafka-bridge, keycloak, elasticsearch-fips, apicurio-registry-fips, hadoop-fips, keycloak-fips, druid, conductor, akhq, airbyte-server, knative-kafka-broker,...

GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: apache-hop, keycloak, apicurio-registry-fips, hadoop-fips, keycloak-fips, knative-kafka-broker, neo4j, apache-hop-fips, apache-pulsar, floci-az, seata, apache-pulsar-fips, apache-activemq-artemis, celeborn, tez, zipkin, thingsboard, hono, knative-kafka-broker-fips,...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: apache-hop, keycloak, apicurio-registry-fips, hadoop-fips, keycloak-fips, knative-kafka-broker, neo4j, apache-hop-fips, apache-pulsar, floci-az, seata, apache-pulsar-fips, apache-activemq-artemis, celeborn, tez, zipkin, thingsboard, hono, knative-kafka-broker-fips,...

CVE-2026-55851 vulnerabilities

Vulnerabilities for packages: apache-hop, keycloak, apicurio-registry-fips, hadoop-fips, keycloak-fips, knative-kafka-broker, neo4j, apache-hop-fips, apache-pulsar, floci-az, seata, apache-pulsar-fips, apache-activemq-artemis, celeborn, tez, zipkin, thingsboard, hono, knative-kafka-broker-fips,...

CVE-2026-59919 vulnerabilities

Vulnerabilities for packages: apache-hop, keycloak, apicurio-registry-fips, hadoop-fips, keycloak-fips, knative-kafka-broker, neo4j, apache-hop-fips, apache-pulsar, floci-az, seata, apache-pulsar-fips, apache-activemq-artemis, celeborn, tez, zipkin, thingsboard, hono, knative-kafka-broker-fips,...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: geoserver, camunda, apache-hop, conductor-fips, keycloak, apicurio-registry-fips, flyway-fips, keycloak-fips, dependency-track-apiserver, druid, conductor, airbyte-server, debezium, ghidra, apache-hop-fips, traccar-fips, nacos-docker, camunda-zeebe, sonarqube,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: geoserver, camunda, apache-hop, conductor-fips, keycloak, apicurio-registry-fips, flyway-fips, keycloak-fips, dependency-track-apiserver, druid, conductor, airbyte-server, debezium, ghidra, apache-hop-fips, traccar-fips, nacos-docker, camunda-zeebe, sonarqube,...