External risk intelligence

Floci API Gateway Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-108598

The vulnerability exists within an API gateway component that allows the creation of REST APIs. API gateways are commonly deployed as internet-facing services to manage and route traffic, making this component frequently exposed to public network access in standard architectural deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A code injection vulnerability has been identified in the VtlTemplateEngine component of Floci software, potentially allowing unauthorized command execution through the manipulation of Velocity mapping templates within a REST API. This could enable attackers to run operating system commands on the Floci server if exploitation is successful. The main concern is confirming relevance and exposure.

Allows remote code execution via template flaws.
Critical flaw in API gateway affects many systems.
Assess exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by creating a REST API with a MOCK integration. This API can then use specially crafted Velocity mapping templates that leverage reflection to access Java classes like Runtime or ProcessBuilder. When these templates are processed, they allow the execution of arbitrary operating system commands within the Floci application's Java Virtual Machine.

No authentication required to access.
Triggered by processing a malicious template.
Leads to OS command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute commands on the Floci JVM by exploiting a code injection vulnerability in the Velocity mapping templates used within the API Gateway's REST API MOCK integrations. This is possible when the mapping templates utilize `$util` reflection to access `Runtime` or `ProcessBuilder`.

Floci JVM processes and OS commands.
Unrestricted Velocity mapping templates.
Arbitrary OS command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the vulnerability in Floci's VtlTemplateEngine, the teams most likely responsible for remediation are those managing the API gateway and application integrations. The immediate first step is to locate all instances of Floci, determine their exposure, and identify the specific application owners responsible for these integrations. Once identified, a risk-based remediation plan, considering maintenance windows and vendor coordination, should be developed.

Application owners should address the issue.
Verify Floci instances and exposure.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Floci and its VtlTemplateEngine?

Floci is an open-source software tool designed for managing and routing API traffic. Its VtlTemplateEngine component is responsible for processing Velocity mapping templates, which define how data is transformed or formatted when passing through the API gateway. Users typically deploy this component to bridge communication between different services by mapping request and response structures.

What does code injection mean for CVE-2026-108598?

This vulnerability falls under the Improper Control of Generation of Code (CWE-94) class. It occurs because the template engine does not restrict what functions a user can call. By submitting a crafted template, an attacker can trick the system into running unintended code, specifically using Java reflection to access powerful system commands that the server should not execute.

How can an attacker trigger this vulnerability?

An attacker must have the ability to define a REST API integration within Floci. By configuring a mock integration that utilizes a malicious Velocity template, the attacker can invoke restricted Java objects. Simply using the standard, legitimate features of the API gateway does not trigger the bug; it requires specifically injecting templates that use the $util reflection capability to access OS-level commands.

Do I need to worry if my Floci instance is internal?

Halo Surface Signal indicates that because this is an API gateway, it is often placed at the network edge to handle external traffic. If your instance is internet-facing, it is at higher risk of unauthorized access. However, internal instances should not be ignored, as any user or service with access to the API configuration interface could potentially exploit this, regardless of the network boundary.

When should I upgrade Floci to address this?

You should prioritize upgrading to version 2.2.0 or later immediately. Since this flaw allows unauthenticated command execution, delaying updates leaves the underlying host system open to complete compromise. Start by creating an inventory of your Floci deployments and coordinate with the teams that manage these API integrations to plan and apply the update during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.