Back vulnerability.circl.lu

CVE-2026-108598 — Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Most recent entries from cvelistv5 / 20h Affected: floci-io floci Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Fl

vulnerability.circl.lu • October 11, 2026

Share: View original

Published Proof of Concept : A public proof of concept is available for this vulnerability.

Exploited : The vulnerability was observed as exploited by the user who reported the sighting.

Patched : The vulnerability was observed as successfully patched by the user who reported the sighting.

Not exploited : The vulnerability was not observed as exploited by the user who reported the sighting.

Not confirmed : The user expressed doubt the validity of the vulnerability.

Not patched : The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Injection Vulnerability in Floci Affects Unauthenticated Users A critical code injection vulnerability, CVE-2026-108598, has been identified in Floci versions 1.1.0 to 2.2.0, allowing unauthenticated attackers to execute arbitrary OS commands via the VtlTemplateEngine. Attackers can exploit this flaw by creating a REST API with a MOCK integration that leverages $util reflection to access Runtime or ProcessBuilder. The vulnerability has a CVSS score of 9.8, indicating its critical nature. Currently, there are no public proof-of-concept exploits available, and remediation efforts are under review. The vulnerability was published on October 10, 2026, but is not listed in the CISA KEV database. The situation remains urgent as organizations are advised to monitor for updates and potential patches. 1 sources 65

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)