Read the docs
TI-2026-70582 Aliases CVE-2026-108598GHSA-c3c4-9g85-pfvc

Code injection in Floci API Gateway mapping templates allows remote commands

Priority HIGH 81CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Floci from 1.1.0 before 2.2.0 contains a code injection flaw in VtlTemplateEngine (CWE-94) where Velocity mapping templates are not restricted. An unauthenticated remote attacker can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, running operating system commands in the Floci JVM. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00931 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed floci (floci-io): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
floci-iofloci1.1.0 to before 2.2.02.2.0Patch availableCNA
  • floci Vendorfloci-io Affected 1.1.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA

Remediation

Upgrade floci-io floci to version 2.2.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA floci (floci-io) Fixed in 2.2.0

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108598
  2. 2026-10-11 Alias added: GHSA-c3c4-9g85-pfvc
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: MEDIUM → HIGH

References

Exploit 1

Patch 1

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences