PT-2026-20796 · Apache · Velocity Template Engine

Robert Raducioiu · Publicado 2026-02-19 · Atualizado 2026-02-24 · CVE-2025-12107

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to Feb. 19, 2026

Description A security flaw exists due to the use of a vulnerable third-party Velocity template engine. An attacker with administrative privileges can inject malicious template syntax, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information. The vulnerability involves the injection and execution of arbitrary template code on the server. This is a Server-Side Template Injection (SSTI) issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

CVE-2025-12107

Produtos afetados

Velocity Template Engine

Referências · 9

• https://osv.dev/vulnerability/CVE-2025-12107 · Aviso do Fabricante
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2024515297898852452 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2024501227908976947 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2024511798032916685 · Publicação no Twitter
• https://t.me/poxek/5938 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-12107 · Nota de Segurança
• https://t.me/CVEtracker/45109 · Publicação no Telegram
• https://twitter.com/CCBalert/status/2024901593821249592 · Publicação no Twitter