CVE Catalog
CVE-2026-38165
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.27%
19th percentile - higher than 19% of all known CVEs
Summary
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.
Risk Assessment
An attacker could execute arbitrary code on the server, potentially leading to full system compromise, data theft, or application disruption.
Recommendation
It is recommended to update xdocreport to the latest version that includes security fixes and avoid processing untrusted template expressions.
Original NVD description (English source)
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.