CVE-2026-108598 Details
Description
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
A code injection vulnerability has been identified in Floci versions 1.1.0 prior to 2.2.0, specifically within the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute commands on the operating system via unrestricted Velocity mapping templates. The issue arises because Floci's API Gateway integration response templates are evaluated with Apache Velocity, which by default, permits reflection into Java classes. Attackers can exploit this by creating a REST API with a MOCK integration that uses the VTL template to access the Runtime or ProcessBuilder classes, ultimately executing OS commands within the Floci JVM environment.
Users can update Floci to version 2.2.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Floci | <= 1.1.0, < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |