Floci 1.1.0 to 2.2.0 Patched for Critical Unauthenticated Code Injection Flaw
A critical vulnerability in Floci allows unauthenticated attackers to execute OS commands via unrestricted Velocity mapping templates in the VtlTemplateEngine.
Key points
- CVE-2026-108598 is rated CVSS 9.3 CRITICAL by the NVD.
- The flaw exists in Floci versions 1.1.0 through 2.2.0.
- Attackers can use $util reflection to reach Runtime or ProcessBuilder.
The National Vulnerability Database (NVD) recorded CVE-2026-108598 as a critical security flaw affecting Floci versions prior to 2.2.0. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host system by exploiting unrestricted Velocity mapping templates within the VtlTemplateEngine component.
At a glance
- CVE
- CVE-2026-108598
- Product
- floci-io floci
- CVSS
- 9.3 Critical
- Weakness
- code injection
- Exploited
- No known exploitation
The NVD assigned a CVSS score of 9.3 to this issue, classifying it as critical. According to the NVD record, the weakness stems from CWE-94, which involves improper control of generation of code. Attackers can create a REST API with a MOCK integration that leverages these templates to inject malicious code into the application’s execution flow.
Context and Background
The exploitation mechanism relies on the $util reflection feature within the Floci environment. Attackers use this feature to access sensitive Java classes such as Runtime or ProcessBuilder. Once access is gained, they can execute operating system commands directly within the Floci Java Virtual Machine (JVM).
This type of code injection vulnerability bypasses standard application logic controls. The NVD description specifies that the attack vector requires no authentication, making it accessible to any remote actor who can reach the API endpoint. The unrestricted nature of the Velocity mapping templates facilitates this direct path to system-level command execution.
Who Is Affected
Floci-io Floci versions 1.1.0 through 2.2.0 are affected by this vulnerability. Organizations running these specific versions of the Floci platform are at risk of remote code execution. The NVD record explicitly states that versions before 2.2.0 contain the flaw, implying that version 2.2.0 and later are not affected by this specific issue.
The impact is severe because the attacker operates within the context of the Floci JVM. This allows for potential full system compromise if the JVM runs with elevated privileges. Security professionals should verify their current Floci version immediately to determine if they fall within the affected range.
What should you do?
Organizations using Floci should check their current version against the affected range. If running version 1.1.0 to 2.2.0, they should plan an immediate upgrade to version 2.2.0 or later. Network administrators should monitor for unusual outbound connections or process spawns from the Floci service.
What to do and how to stay safe: Floci
- Verify the installed version of Floci to ensure it is 2.2.0 or newer, as older versions are vulnerable to remote code execution.
- Monitor server logs for unexpected REST API calls to MOCK endpoints or unusual Velocity template usage patterns that may indicate exploitation attempts.
- Restrict network access to Floci API endpoints using firewall rules or web application firewalls to limit exposure to unauthenticated external attackers.
- Review JVM permissions and container configurations to minimize the potential impact of any successful code injection by limiting system-level command execution capabilities.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108598?
The NVD rates CVE-2026-108598 as CVSS 9.3, which is classified as critical.
Which versions of Floci are affected by this vulnerability?
Floci versions 1.1.0 through 2.2.0 are affected by this code injection vulnerability.
How do attackers exploit this flaw?
Attackers create a REST API with a MOCK integration using unrestricted Velocity mapping templates to execute OS commands via $util reflection.
