Read the docs
TI-2026-22563 Aliases CVE-2026-28228

OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution

Priority MEDIUM 40CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed (either triggered manually or via the daily cron job), the injected directives are evaluated server-side. By chaining Velocity's #set directive with Java reflection, an attacker can instantiate arbitrary Java classes such as java.lang.ProcessBuilder and execute operating system commands with the privileges of the Tomcat process (typically root in containerized deployments). This issue has been patched in versions 19.1.31, 20.1.18, and 20.2.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed OpenOLAT (OpenOLAT): 19.1.31, 20.1.18, 20.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenOLATOpenOLATbefore 19.1.31; before 20.1.18; before 20.2.519.1.31, 20.1.18, 20.2.5Patch availableCNA
  • OpenOLAT VendorOpenOLAT Affected before 19.1.31; before 20.1.18; before 20.2.5 Fixed in 19.1.31, 20.1.18, 20.2.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*before 19.1.31; 20.0.0 to before 20.1.18; 20.2.0 to before 20.2.5VulnerableOpenOLAT
  • cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:* Versions before 19.1.31; 20.0.0 to before 20.1.18; 20.2.0 to before 20.2.5 Vulnerable ·OpenOLAT

Remediation

  • Fix · CNA OpenOLAT (OpenOLAT) Fixed in 19.1.31, 20.1.18, 20.2.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28228

References

Advisory 1

  • TI-2024-17072 Stored Cross-Site Scripting (XSS) within the Media Center CVSS 3.1MEDIUM 5.4
  • TI-2026-24492 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow CVSS 3.1CRITICAL 9.8
  • TI-2021-16566 Path Traversal in Archive Handling Leading to Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-16567 Unsafe Deserialization of User Data Using XStream CVSS 3.1HIGH 8.8
  • TI-2021-18077 Path Traversal in some REST methods leading to file upload to arbitrary places CVSS 3.1HIGH 8.1
  • TI-2021-17991 Path Traversal in Folder Component Leading to Local File Inclusion CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences