Threat database

Floci versions from 1.1.0 up to but not including 2.2.0 contain a critical code injection vulnerability in the VtlTemplateEngine component. This flaw allows unauthenticated attackers to execute arbitrary OS commands within the Floci JVM by exploiting unrestricted Velocity mapping templates. Specifically, attackers can create a REST API with a MOCK integration that uses $util reflection to access Runtime or ProcessBuilder, enabling command execution.