CVE-2026-108598

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108598

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108598.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108598

Aliases

GHSA-3p4c-wp7w-mgjx

Published

2026-10-10T18:58:14Z

Modified

2026-10-28T11:06:29Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Details

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108598.json"
}

References

Affected packages

Git / github.com/floci-io/floci

Affected ranges

Type

GIT

Repo

https://github.com/floci-io/floci

Events

Introduced

d707d0da70edf78aa7547282b6eb49d8db962e48

Fixed

17c99047b92b5729b356f3584513cd6ed598b8a9

Fixed

144b90e6fa861a5ac882e99a090d503da01945c4

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.1.0"
                },
                {
                    "fixed":  "2.2.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "144b90e6fa861a5ac882e99a090d503da01945c4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.2.0",
            "range":  [
                {
                    "fixed":  "17c99047b92b5729b356f3584513cd6ed598b8a9"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108598.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237464387307487797801296022331324167665",
                "155055968904486286303572829535482134893"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108598-089c7ca5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/test/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngineTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "219564541283549304929405821122290528161",
            "length":  810
        },
        "id":  "CVE-2026-108598-25e98671",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java",
            "function":  "evaluate"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "337556887306564100220486753157810863178",
            "length":  468
        },
        "id":  "CVE-2026-108598-3824d8a3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java",
            "function":  "VtlTemplateEngine"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "109058830464411089957630410407619479136",
            "length":  1149
        },
        "id":  "CVE-2026-108598-5009f95f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/appsync/graphql/AppSyncVtlEngine.java",
            "function":  "evaluate"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "326199622255812619410958346297149853307",
                "226400214923390829354745032932937344101",
                "4864709583270283320984018832340369255",
                "309863265818771739415307109241154281200",
                "177245031895185921977414554052089712091",
                "70003122743955899796886790664724782029",
                "293878200151390418833283167027868823411",
                "299021686199126457917257033022243112337",
                "290594329858939859587913721010061468047",
                "154889585652571829187981481073093973160",
                "289048755610672007119242891854861938785",
                "99084542318968705045804080093149223765",
                "318195849346182236069293476705589450728",
                "85737391108291321833669478641409291042",
                "228716720937667322009870478665805681631",
                "154842273468518378681860854320216181034",
                "231455649466758915985912956951574049822",
                "53607793972560323334873886988358273104",
                "212004920707068450452356516861523148898",
                "178255362774634951197124854737374459422",
                "327493965084352012186596843805446268145",
                "77874965323154622736435568265505948898",
                "35939616417027281126964944586230672809",
                "305526082253616853969890323985978373717",
                "108913581540450903359239816485390782577"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108598-6109d5a9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/appsync/graphql/AppSyncVtlEngine.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "109729936221129094377476129046505307753",
                "155649384134188830898918524684931398483",
                "134012546629723832173918414425184568209",
                "293980568128253957691020793957307003116",
                "289604006180380939832401112540230661178",
                "163138595754866391585199435082224045930",
                "236900645204384912516477376883037917823",
                "141099291748670422473662156462448989062"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108598-8a2f44c3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/config/EmulatorConfig.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "330446669107803809189737012244992972005",
                "92602938317027330178686148460292673482"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108598-9b930a0d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/test/java/io/github/hectorvent/floci/services/appsync/graphql/AppSyncVtlEngineTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "82608821870321002144989763208670830885",
            "length":  630
        },
        "id":  "CVE-2026-108598-d03bec23",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/appsync/graphql/AppSyncVtlEngine.java",
            "function":  "AppSyncVtlEngine"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "246862113481275018905568822379637883989",
                "167161615074529972627426899476563487856",
                "3445235241514113581672241111375596880",
                "78093416524998537190584569234107309561",
                "105557240600736528251715126169648185276",
                "200437393200677059288418961834817252347",
                "1136651549568999433605490835351348506",
                "237856935664914359044396348250784451612",
                "333588970234248777322665698437810001542",
                "43027720265029004991886193957346976885",
                "334005053494257290598737093939650433713",
                "60530113692917531432941749388898466705",
                "112177049550919323242287903547089292325",
                "56123512972518984721182686542258354851",
                "247835974388287966258572153419257233566",
                "315925846261776636459363953714058402472",
                "279286925313598801942258333627503541365",
                "87456133321175933026882555487547827139",
                "176536689583677280614772709774600627161",
                "287359286900676859482861637571920085441",
                "43974958525959890805323492344232214935",
                "2153675384727036896286899118175078505",
                "127259172539979495007355414077530927347",
                "1922469765581837677009373701598062317",
                "87159786014670229556476103381884331095",
                "187455046859446380892939957516342785500",
                "290155843327109173899320303808145673185",
                "63496119788533091783792387019683581754",
                "318143465690523416641773302308347835284",
                "7896393851066146348871524743161908799",
                "98798589708008391218223221541010311079",
                "212057725911030795612626995160904431678",
                "161632529074917419022039317041968709082",
                "69094319805231859528187169881689455488",
                "139332549466953277903655056449915681139",
                "264623534226500309378641751222710527328",
                "228395426620659415412885320398686639392",
                "96861581225666439449649111225000986271",
                "95864289723032072272527687919720816503",
                "296775950169884273584941225676403783450",
                "213147494774178940187865605790970969663"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108598-fe02d79b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4",
        "target":  {
            "file":  "src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:06:29Z"