External risk intelligence

xdocreport Velocity SSTI Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-38165

xdocreport is a library used within applications to process documents. While it can be integrated into internet-facing web applications that accept user-submitted files or templates, it is not an edge service or public-facing appliance by design. Public exposure depends on the specific application implementation, making internet reachability possible but not inherent to the product's primary role.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security vulnerability in the Velocity template engine, specifically within the xdocreport software. The issue, known as Server-Side Template Injection, could allow unauthorized parties to execute arbitrary code, posing a significant risk to systems that use this technology for document processing. The primary concern is to verify if xdocreport is in use and whether it is configured in a way that exposes this vulnerability.

Code execution risk in document processing software.
Critical vulnerability requires immediate attention for potential impact.
Confirm usage and exposure of this specific software component.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted input to an application that uses a vulnerable version of xdocreport. This input, containing a malicious Velocity template expression, could be processed by the server, leading to the execution of arbitrary code.

No authentication or user interaction needed.
Server processes crafted Velocity template.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport could allow attackers to execute arbitrary code by crafting a malicious expression. This could affect system data, user data, and service behavior when the affected component is exposed and processes untrusted input.

Arbitrary code execution on the server.
Crafted input via a vulnerable endpoint.
Compromise of system integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Server-Side Template Injection vulnerability in the Velocity template engine used by xdocreport impacts teams responsible for applications that process documents via this library. The immediate first step is to identify all deployments of xdocreport within your environment, assess their exposure, and determine business criticality to prioritize remediation efforts.

Application owners should lead the remediation.
Verify xdocreport deployment and exposure.
Plan risk-based remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is xdocreport and how is it used?

xdocreport is a Java library designed to merge data with document templates, such as Microsoft Word or LibreOffice files, to generate reports. Developers integrate it into their custom software applications to automate document creation, allowing users to download populated files. Because it acts as a backend engine for processing these templates, it is typically hidden inside larger application stacks rather than functioning as a standalone service.

What does Server-Side Template Injection mean for CVE-2026-38165?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. It occurs because the software fails to properly sanitize template expressions before processing them. In the context of CVE-2026-38165, an attacker can input malicious commands into a document template. When the server processes this file, the engine interprets the input as executable instructions, allowing the attacker to run unauthorized code on the host system.

How does an attacker trigger this code execution?

An attacker triggers the vulnerability by submitting a crafted Velocity template expression to an application that uses the affected xdocreport library. The vulnerability requires the application to process untrusted or user-supplied input as a template. Simply having the library installed in a non-active state or using it to process only internal, trusted files does not inherently trigger this flaw.

Is my system at risk if I use xdocreport?

According to Halo Surface Signal, xdocreport is not an edge appliance by design, so its public exposure depends entirely on how your application is built. If your web application allows users to upload or submit their own document templates for processing, the risk is higher. You should care most if the library is reachable by untrusted input, as this increases the likelihood that an attacker could reach the vulnerable component.

Do I need to take action to secure my environment?

Yes, you should begin by creating a comprehensive inventory to identify where xdocreport versions 0.9.2 through 2.2.0 are deployed across your infrastructure. Once identified, evaluate if those specific application endpoints accept untrusted or user-defined templates. Prioritize your remediation efforts by focusing on the most critical, internet-facing applications first, and coordinate with your internal development teams to manage potential updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.