CVE-2026-38165 in xdocreport
Summary
by MITRE • 08/18/2026
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified vulnerability represents a critical security flaw within the Apache XDocReport library, specifically affecting versions ranging from 0.9.2 through 2.2.0. This issue stems directly from improper neutralization of special elements used in server-side template injection attacks against the Velocity template engine integration embedded within the application logic. Server-Side Template Injection is a severe class of vulnerability that occurs when an attacker can inject malicious code into templates processed by the server, rather than just client-side scripts. In this specific context, the library fails to adequately sanitize or validate user-supplied input before it is passed as part of a template expression evaluated by Velocity. This lack of rigorous input validation allows external data to be interpreted not merely as static content but as executable code within the engine's runtime environment.
The technical mechanism behind this exploitation relies on the powerful scripting capabilities inherent in the Apache Velocity templating engine. While designed for generating dynamic text output, Velocity includes features that allow for complex expressions and even direct access to Java objects under certain configurations. When an attacker crafts a specific expression containing malicious payload code, such as invoking static methods or instantiating dangerous classes like java.lang.Runtime, the template engine processes this input without sufficient restriction. The vulnerability essentially bypasses any intended separation between data and logic, enabling the execution of arbitrary system commands on the host server where the application is deployed. This capability transforms a simple document generation tool into a potential remote code execution vector with significant consequences for infrastructure integrity.
The operational impact of exploiting this Server-Side Template Injection flaw is profound and potentially catastrophic. Successful exploitation allows an authenticated or unauthenticated attacker, depending on the specific implementation context of XDocReport within the target application, to execute arbitrary commands at the operating system level. This can lead to complete compromise of the underlying server, including unauthorized access to sensitive data stored locally, modification of critical files, or use of the compromised host as a pivot point for further network attacks. The ability to run code with the privileges of the web service account means that attackers could potentially escalate their rights if configuration weaknesses exist elsewhere in the system. Furthermore, because XDocReport is often used for generating reports and documents from templates, this vulnerability may be triggered through seemingly benign document upload or template rendering features, making it difficult to detect without specialized monitoring tools focused on input validation anomalies.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the Apache XDocReport library to a version that includes patches for this vulnerability, ensuring that all dependencies are updated to their latest secure releases. If upgrading is not immediately feasible, organizations should implement strict input validation mechanisms at the application layer to prevent malicious template expressions from reaching the Velocity engine. This involves whitelisting allowed characters and rejecting any input containing syntax indicative of code injection attempts. Additionally, deploying a Web Application Firewall with rules specifically tuned for detecting Server-Side Template Injection patterns can provide an additional layer of defense by blocking suspicious requests before they reach the vulnerable component. It is also advisable to review application configurations to ensure that Velocity engines are running in sandboxed modes where possible, restricting access to dangerous Java classes and methods to minimize the blast radius even if exploitation occurs.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-94, which covers Improper Control of Generation of Code or Script, often referred to as code injection. From a tactical perspective, it maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically the sub-technique involving Java-based execution vectors like Jython or direct JVM interactions. Understanding these mappings helps security teams prioritize response efforts based on established industry frameworks for threat classification and mitigation prioritization. Regular vulnerability scanning and penetration testing focused on template engines are essential to identify similar misconfigurations in other parts of the application stack that might rely on dynamic content generation features.