PT-2026-20796 · Apache · Velocity Template Engine

Robert Raducioiu · CVE-2025-12107 · Published 2026-02-19 · Updated 2026-02-24

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to Feb. 19, 2026

Description A security flaw exists due to the use of a vulnerable third-party Velocity template engine. An attacker with administrative privileges can inject malicious template syntax, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information. The vulnerability involves the injection and execution of arbitrary template code on the server. This is a Server-Side Template Injection (SSTI) issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-12107

Affected Products

Velocity Template Engine

References · 9

• https://osv.dev/vulnerability/CVE-2025-12107 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12107 · Security Note
• https://twitter.com/TheHackerWire/status/2024515297898852452 · Twitter Post
• https://twitter.com/CVEnew/status/2024501227908976947 · Twitter Post
• https://twitter.com/CveTodo/status/2024511798032916685 · Twitter Post
• https://t.me/poxek/5938 · Telegram Post
• https://t.me/CVEtracker/45109 · Telegram Post
• https://twitter.com/CCBalert/status/2024901593821249592 · Twitter Post