Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-108598 . See article
NVD published the first details for CVE-2026-108598
A CVSS base score of 9.8 has been assigned.
A critical code injection vulnerability exists in the Floci component, allowing unauthenticated attackers to exploit a REST API configured with a MOCK integration to execute arbitrary OS commands through reflection. With a CVSS severity of 9.8, this vulnerability does not have any public proof-of-concept exploits available yet, and current remediation efforts are under review. No specific mitigations are noted, and the vulnerability is not listed in the CISA KEV database. See article
CVE-2026-108598: Floci 1.1.0-2.2.0 Unauthenticated RCE via Velocity Template Injection
CVE-2026-78535: Photolia Unauthenticated PHP Object Injection Enables Critical Remote Exploitation
CVE-2026-78533: Qwery Unauthenticated PHP Object Injection Poses Critical Remote Compromise Risk
CVE-2026-108598 - Exploits & Severity - Feedly
Code Injection Duo — 2 CVEs, Peak CVSS 9.8 in openapi-typescript-codegen and Floci Velocity
CVE-2026-78535: Photolia Unauthenticated PHP Object Injection Enables Critical Remote Exploitation
CVE-2026-78533: Qwery Unauthenticated PHP Object Injection Poses Critical Remote Compromise Risk
CVE-2026-108598 — Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
