CVE-2026-28228 Details
Description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed (either triggered manually or via the daily cron job), the injected directives are evaluated server-side. By chaining Velocity's #set directive with Java reflection, an attacker can instantiate arbitrary Java classes such as java.lang.ProcessBuilder and execute operating system commands with the privileges of the Tomcat process (typically root in containerized deployments). This issue has been patched in versions 19.1.31, 20.1.18, and 20.2.5.
A server-side template injection vulnerability has been identified in OpenOLAT, an open-source e-learning platform. This issue affects versions prior to 19.1.31, 20.1.18, and 20.2.5. The vulnerability allows an authenticated user with the Author role to inject Velocity directives into a reminder email template. When the reminder is processed, either manually or via a daily cron job, the injected directives are evaluated on the server. By exploiting this feature, an attacker can use Velocity's #set directive in conjunction with Java reflection to execute arbitrary operating system commands. The commands are executed with the privileges of the Tomcat process, which is typically root in containerized deployments.
Users are advised to upgrade to OpenOLAT versions 19.1.31, 20.1.18, or 20.2.5. If an immediate upgrade is not possible, the Author role should be restricted to trusted users only, and the course reminder feature can be disabled via system configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-55qg-vvgj-ffh4 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frentix openolat | < 19.1.31 >= 20.0.0, < 20.1.18 >= 20.2.0, < 20.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |