Description

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T23:16:51.230Z",
  "pubdate": "2026-08-17T23:16:51.230Z",
  "executiveSummary": "A Server-Side Template Injection (SSTI) vulnerability exists within the Velocity template engine configuration of xdocreport versions v0.9.2 to v2.2.0. This security flaw allows remote attackers to execute arbitrary system code through a crafted expression. The vulnerability resides in the core template processing logic of the affected product, where user-supplied input is improperly handled and evaluated within the template context. Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the underlying application server, posing severe risks including complete system compromise, data exfiltration, and lateral movement. Exploitation typically requires an attacker to submit malicious template syntax via inputs processed by the vulnerable report generation mechanism. Remediation requires updating to patched versions of xdocreport or applying strict input sanitization and context isolation to prevent template evaluation of untrusted data.",
  "technicalDetails": "The vulnerability is classified as a Server-Side Template Injection (SSTI) impacting the Velocity template engine implementation within xdocreport versions v0.9.2 through v2.2.0. The root cause stems from the insecure configuration and evaluation of template expressions derived from untrusted input without adequate sandboxing or sanitization.\nThe vulnerable component is the document rendering and template evaluation pipeline responsible for processing user-supplied data directives within xdocreport. During the report generation phase, the application passes input parameters directly into the Velocity template engine context or evaluation functions. Because the engine interprets specific syntax sequences as executable code constructs, an attacker can craft malicious template expressions leveraging Java reflection or internal API calls exposed through the template context.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector within the application that feeds data into the xdocreport document generation engine using the Velocity template engine. Second, the attacker crafts a malicious payload containing Velocity directives (such as #set or method chaining via reference objects) designed to instantiate Java classes like java.lang.Runtime or ProcessBuilder. Third, the application processes the input by evaluating the template expression within the server-side context. Finally, the evaluation of the crafted expression invokes underlying system commands, resulting in remote code execution on the host operating system.\nAuthentication and privilege requirements depend on the specific application implementation exposing the xdocreport functionality, but exploitation can be achieved remotely if the input vector is accessible to unauthenticated users or low-privileged accounts. Network exposure is typically tied to the web application or service utilizing the vulnerable library. Post-exploitation impact includes full system compromise, access to sensitive databases or internal network resources, and deployment of persistent malware or backdoors."
}