What is the CVSS score of EUVD-2026-60545?

EUVD-2026-60545 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of xdocreport are affected by EUVD-2026-60545?

OpenSagres XDocReport versions 0.9.2-2.2.0 contain a critical remote code execution vulnerability that enables attackers to fully compromise application servers when processing untrusted document…

How to fix or mitigate EUVD-2026-60545?

Within 24 hours, audit all applications and systems in your environment to identify usage of OpenSagres XDocReport versions 0.9.2-2.2.0 and assess whether they process untrusted or external document templates; activate incident response protocols and immediately restrict network access to vulnerable systems from internet-facing networks. Within 7 days, contact the OpenSagres vendor to determine if patched versions are available for upgrade, and in parallel implement compensating controls including strict input validation and sanitization of all template sources, network segmentation to isolate affected systems, and disabling of template processing functionality where not essential to business operations. Within 30 days, complete any vendor-recommended patches or upgrades, verify the effectiveness of compensating controls through security testing, and establish continuous monitoring for exploitation attempts.

xdocreport EUVD-2026-60545

| CVE-2026-38165 CRITICAL

Code Injection (CWE-94)

2026-08-17 mitre

GHSA-7747-6373-9653

RCE Code Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

When the app renders untrusted content as a Velocity template, exploitation is unauthenticated, network-reachable, low-complexity RCE with full CIA loss; the untrusted-template requirement is an application deployment condition, not a base metric.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 18, 2026 - 12:23 vuln.today

Analysis Generated

Aug 18, 2026 - 12:23 vuln.today

CVSS changed

Aug 18, 2026 - 12:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 17, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.

AnalysisAI

Remote code execution in opensagres xdocreport (versions 0.9.2 through 2.2.0) arises because the bundled Velocity template engine ships with the insecure default UberspectImpl introspector, letting a crafted Velocity expression reach reflective JDK classes and run arbitrary code. Any application that renders untrusted template content through xdocreport's Velocity engine is exposed to full server compromise. Publicly available exploit code exists (a dedicated PoC GitHub repository and two HackMD write-ups), though the flaw is not listed in CISA KEV and no EPSS score was supplied.

Technical ContextAI

xdocreport is a Java library for generating reports (DOCX/ODT/PDF) from templates, and its fr.opensagres.xdocreport.template.velocity module wraps Apache Velocity. The root cause (CWE-94, Code Injection) is a configuration weakness: xdocreport-velocity.properties set 'introspector.uberspect.class = org.apache.velocity.util.introspection.UberspectImpl', the permissive default introspector that allows templates to call getClass().forName() and reach java.lang.Runtime/Process/ClassLoader via reflection. Server-Side Template Injection occurs when attacker-controlled data is evaluated as a Velocity expression; without a secure introspector, this converts into arbitrary code execution. The fix (PR #723) switches the default to org.apache.velocity.util.introspection.SecureUberspector and adds introspector.restrict.packages (java.lang.reflect) and an explicit restrict.classes deny-list (Class, ClassLoader, Runtime, Process, System, Thread, etc.), with a regression test confirming Class.forName() is blocked. The CPE provided is a placeholder ('n/a'), so exact machine-readable product identification is unavailable.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in https://github.com/opensagres/xdocreport/pull/723, which sets runtime.introspector.uberspect to org.apache.velocity.util.introspection.SecureUberspector by default and restricts reflective classes/packages; upgrade to a release built after v2.2.0 that incorporates PR #723 once published, or build from the patched source. Until a tagged release is available, apply the same hardening in your own application by explicitly setting runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector plus introspector.restrict.packages=java.lang.reflect and the class deny-list (java.lang.Runtime, Process, System, ClassLoader, Class, Thread, etc.) in the Velocity properties you pass to xdocreport - this preserves normal POJO/property access while blocking the reflective escape (side effect: templates that legitimately call restricted JDK reflection will break). As a deployment control, treat all template content as untrusted: do not allow end users to upload or influence Velocity template sources, and validate/sandbox any dynamic template input. See VulDB https://vuldb.com/vuln/391515 for tracking.