{"vulnerability": "cve-2026-108598", "sightings": [{"uuid": "05692309-4177-4cc4-925c-550facebd0ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418160135251747", "content": "CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108598https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjxhttps://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-pochttps://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4https://github.com/floci-io/floci/releases/tag/2.2.0https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114https://github.com/floci-io/flocihttps://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates#floci-io #floci#CVE_2026_108598#bot", "creation_timestamp": "2026-10-10T19:02:18.114924Z"}, {"uuid": "3869210a-d525-4a62-958a-0a61d48585f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxka3jqqyk2a", "content": "\ud83d\udd34 CVE-2026-108598 - Critical (9.8)\n\nFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108598/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T19:31:31.152479Z"}, {"uuid": "12352aa8-2c70-4467-b50d-7dc4ff08eddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxkc475i5t2l", "content": "\ud83d\udea8 CVE-2026-108598 \u2014 CVSS 9.3 CRITICAL\n\nFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthent...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108598\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T20:07:40.476838Z"}, {"uuid": "2c5d3d10-7d5e-40e0-be92-d6402626b46d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108598", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkcaiy2ve2n", "content": "CVE-2026-108598\nVersions 1.1.0 up to but not including 2.2.0 of Floci let anyone send specially crafted templates that run operating\u2011system commands on the server. This could let attackers take control of the system hosting\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-10T20:10:05.267538Z"}]}