{"uuid": "05692309-4177-4cc4-925c-550facebd0ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418160135251747", "content": "CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108598https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjxhttps://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-pochttps://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4https://github.com/floci-io/floci/releases/tag/2.2.0https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114https://github.com/floci-io/flocihttps://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates#floci-io #floci#CVE_2026_108598#bot", "creation_timestamp": "2026-10-10T19:02:18.114924Z"}