What is the CVSS score of CVE-2026-28228?

CVE-2026-28228 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-28228?

CVE-2026-28228 is a server-side template injection vulnerability in OpenOlat e-learning platform that allows authenticated users with Author role to execute arbitrary operating system commands,…. A patch is available.

How to fix or mitigate CVE-2026-28228?

Within 24 hours: Identify all OpenOlat instances in production and verify current versions against 19.1.31, 20.1.18, and 20.2.5 baselines; restrict Author role assignments to trusted personnel only. Within 7 days: Apply vendor-released patch for your OpenOlat version branch (19.1.31, 20.1.18, or 20.2.5 or later). Within 30 days: Audit email template configurations for suspicious Velocity directives; review access logs for Author role activity between vulnerability disclosure and patch deployment; re-baseline privileged account access.

Java CVE-2026-28228

EUVD-2026-17201 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-03-30 GitHub_M

Java Tomcat Ssti Code Injection

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:10 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

20.2.5,20.1.18,19.1.31

EUVD ID Assigned

Mar 30, 2026 - 21:00 euvd

EUVD-2026-17201

Analysis Generated

Mar 30, 2026 - 21:00 vuln.today

CVE Published

Mar 30, 2026 - 20:31 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed (either triggered manually or via the daily cron job), the injected directives are evaluated server-side. By chaining Velocity's #set directive with Java reflection, an attacker can instantiate arbitrary Java classes such as java.lang.ProcessBuilder and execute operating system commands with the privileges of the Tomcat process (typically root in containerized deployments). This issue has been patched in versions 19.1.31, 20.1.18, and 20.2.5.

AnalysisAI

Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.

Technical ContextAI

This vulnerability exploits Apache Velocity template engine's server-side template injection (SSTI) weakness, classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). OpenOlat's reminder email functionality allows authenticated Authors to define email templates processed by the Velocity engine during scheduled cron jobs or manual trigger events. Velocity's #set directive combined with Java reflection capabilities enables attackers to break template sandbox constraints and access the underlying Java runtime. By chaining reflection calls, attackers instantiate java.lang.ProcessBuilder to spawn arbitrary system processes. The affected CPE (cpe:2.3:a:openolat:openolat:*:*:*:*:*:*:*:*) encompasses all OpenOlat versions before the patched releases across three major version branches (19.1.x, 20.1.x, 20.2.x). The vulnerability specifically targets Java-based deployments running on Apache Tomcat application servers, where the execution context typically inherits the container's privilege level.

RemediationAI

Organizations must immediately upgrade to patched OpenOlat versions: 19.1.31 for the 19.1.x branch, 20.1.18 for the 20.1.x branch, or 20.2.5 for the 20.2.x branch. Vendor-released patches are available through the official GitHub repository and address the template injection vulnerability by implementing proper input sanitization and Velocity engine sandbox restrictions. Until patching is feasible, interim mitigations include restricting the Author role to only highly trusted users, implementing strict role-based access controls to minimize accounts with template editing privileges, disabling or closely monitoring reminder email functionality, and deploying web application firewalls configured to detect Velocity directive patterns in HTTP requests. For containerized deployments, reduce blast radius by running Tomcat processes with non-root user privileges and implementing container security policies that restrict process spawning capabilities. Complete remediation guidance and patch download links are available in the GitHub security advisory at https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-55qg-vvgj-ffh4. Organizations should audit existing reminder templates for malicious content and review access logs for suspicious Author account activity during the vulnerability window.