CVE-2026-108598 in Floci
Summary
by MITRE • 10/10/2026
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in versions of Floci prior to 2.2.0 represents a critical server-side code injection flaw rooted in the improper handling of Velocity Template Language inputs within the VtlTemplateEngine component. This security defect allows unauthenticated remote attackers to achieve arbitrary command execution on the underlying Java Virtual Machine hosting the application. The core issue stems from the engine's ability to process unrestricted mapping templates, which serve as a bridge between user-supplied data and the internal runtime environment of the Floci service. By leveraging the reflective capabilities inherent in the Velocity template language, specifically through the $util reflection mechanism, attackers can bypass standard input validation controls that might otherwise restrict access to sensitive Java classes or methods.
From a technical perspective, the exploitation vector relies on the integration of REST APIs configured with MOCK integrations within Floci's architecture. When an attacker constructs a request targeting such an endpoint and supplies a maliciously crafted Velocity template as part of the payload, the VtlTemplateEngine processes this input without sufficient sanitization or sandboxing. The critical failure occurs when the engine permits the invocation of Java reflection APIs via the $util utility object. This allows the injected code to instantiate classes that are normally inaccessible from within the templating context, such as java.lang.Runtime and java.lang.ProcessBuilder. Once these classes are instantiated through reflection, the attacker can invoke methods like exec() or startProcess(), effectively spawning operating system processes with the privileges of the Floci application user.
The operational impact of this vulnerability is severe, resulting in a complete compromise of the host environment running the Floci service. Since the executed commands run within the context of the Java process, an attacker gains full control over the underlying operating system. This can lead to data exfiltration, lateral movement across internal networks by pivoting through compromised hosts, installation of persistent backdoors or malware, and potential denial-of-service conditions if destructive commands are issued. The fact that this vulnerability is exploitable without authentication significantly lowers the barrier for entry, allowing any network-accessible actor with knowledge of the API structure to exploit it remotely.
This flaw aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-78, the OS Command Injection vulnerability class. In terms of offensive security frameworks, this exploitation technique maps directly to MITRE ATT&CK tactic T1059, specifically sub-technique 004 for command and scripting interpretation using Java-based payloads like Velocity templates. The use of reflection to bypass access controls is a common pattern in such attacks, highlighting the danger of exposing powerful internal APIs to untrusted input sources without rigorous validation or isolation mechanisms.
To mitigate this vulnerability, organizations must immediately upgrade Floci to version 2.2.0 or later, where these restrictions on template processing and reflection usage have been addressed by the developers. For environments that cannot be patched instantly, implementing strict network-level access controls is essential; specifically, REST API endpoints should not be exposed to untrusted networks without robust authentication mechanisms such as OAuth2 or mutual TLS. Additionally, deploying a Web Application Firewall with rules capable of detecting Velocity template injection patterns can provide an additional layer of defense by blocking requests containing suspicious reflection calls or command execution syntax before they reach the application logic. It is also advisable to run Floci instances within restricted containers or sandboxed environments with minimal privileges to limit the blast radius in case a compromise occurs, ensuring that even if code execution is achieved, the attacker cannot easily escalate privileges or access sensitive host resources.