PT-2026-29118 · Openolat · Openolat

Fkt · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-28228

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenOlat versions prior to 19.1.31 OpenOlat versions prior to 20.1.18 OpenOlat versions prior to 20.2.5

Description OpenOlat is a web-based e-learning platform. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role could inject Velocity directives into a reminder email template. When the reminder is processed, the injected directives are evaluated server-side. By chaining Velocity's #set directive with Java reflection, an attacker can instantiate arbitrary Java classes, such as java.lang.ProcessBuilder, and execute operating system commands with the privileges of the Tomcat process. The ProcessBuilder class is a Java class used to create operating system processes.

Recommendations Update OpenOlat to version 19.1.31 or later. Update OpenOlat to version 20.1.18 or later. Update OpenOlat to version 20.2.5 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-28228

GHSA-55QG-VVGJ-FFH4

Affected Products

Openolat

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28228.json · Exploit
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-55qg-vvgj-ffh4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28228 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28228 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2038734063003926676 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038743155416445043 · Twitter Post
• https://twitter.com/CVEnew/status/2038916082740932933 · Twitter Post
• https://twitter.com/CveFindCom/status/2038733702449029192 · Twitter Post