CVE-2026-108598GHSA-3p4c-wp7w-mgjx
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
floci-io floci
CVSS
9.3CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.73%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.0flociCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
Text from CVE List
Affected versions 1
- flociaffected: 1.1.0 before 2.2.0CVE List
References 7
- github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4Fixvia CVE List
- github.com/floci-io/floci/releases/tag/2.2.0Fixvia CVE List
- github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjxAdvisoryvia CVE List
- vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templatesAdvisoryvia CVE List
- github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-pocExploitvia CVE List
- github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114Referencevia CVE List
- github.com/floci-io/flociReferencevia CVE List