CVE-2026-38165 Overview
CVE-2026-38165 is a Server-Side Template Injection (SSTI) vulnerability in the Apache Velocity template engine configuration of XDocReport. The flaw affects versions v0.9.2 through v2.2.0 of the opensagres/xdocreport library. Attackers can execute arbitrary code on the host by supplying crafted Velocity expressions that the engine evaluates without adequate sandboxing. XDocReport is widely used in Java applications to merge Office documents (DOCX, ODT) with Java models, so the affected code path frequently sits behind document generation endpoints. The vulnerability is categorized as Improper Control of Generation of Code [CWE-94].
Critical Impact
Unauthenticated network attackers can achieve remote code execution on any Java application that renders untrusted content through XDocReport's Velocity engine configuration.
Affected Products
- XDocReport v0.9.2 through v2.2.0
- Java applications embedding opensagres/xdocreport for DOCX/ODT report generation
- Downstream libraries and services depending on vulnerable XDocReport releases
Discovery Timeline
- 2026-08-17 - CVE-2026-38165 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-38165
Vulnerability Analysis
XDocReport integrates the Velocity template engine to substitute variables inside Office document templates. In vulnerable versions, the Velocity Context and RuntimeInstance are configured without restricting access to Java reflection classes or introspection uberspects. When user-controlled data reaches a template field, the engine parses expressions such as #set directives and method invocations against arbitrary Java objects. This lets an attacker pivot from template evaluation to full Java runtime access, including invoking java.lang.Runtime.exec() through class reflection.
Root Cause
The root cause is the absence of a SecureUberspector or equivalent introspection filter in the Velocity engine configuration [CWE-94]. Velocity, by default, permits reflective access to any reachable object graph. Because XDocReport injects live Java model objects into the template context, an attacker can traverse from those objects to Class, ClassLoader, and Runtime references and execute native commands.
Attack Vector
An attacker submits a document template or a data value that contains a malicious Velocity expression. When the application calls XDocReport's report processor, Velocity evaluates the expression server-side. No authentication or user interaction is required when the affected endpoint accepts untrusted template content or field values. Public proof-of-concept material is published at the CVE-2026-38165 PoC repository and analyzed in the HackMD technical overview.
The exploitation pattern chains a benign object in the template context to obtain a Class reference, then reflectively invokes Runtime.getRuntime().exec() with an attacker-controlled command string. See the XDocReport Pull Request #723 for the maintainer's remediation approach.
Detection Methods for CVE-2026-38165
Indicators of Compromise
- Velocity syntax such as #set, $class.forName, or getClass().forName( present in HTTP request bodies, uploaded DOCX/ODT templates, or database-backed template fields.
- Java processes hosting XDocReport spawning child processes like sh, bash, cmd.exe, powershell.exe, or curl.
- Outbound network connections initiated by the Java application server to unexpected destinations following report-generation requests.
Detection Strategies
- Inspect application logs for XDocReport template processing errors that reference MethodInvocationException or reflection failures, which often indicate probing attempts.
- Deploy runtime application self-protection or EDR rules that flag JVM processes executing OS shells, a behavior inconsistent with normal report rendering.
- Perform software composition analysis to identify xdocreport artifacts in the range 0.9.2 to 2.2.0 across build manifests and deployed JARs.
Monitoring Recommendations
- Alert on any child process creation from Java application servers such as Tomcat, Jetty, or Spring Boot embedded runtimes.
- Log and review all inbound requests to endpoints that accept template files or dynamic template fields.
- Correlate report-generation activity with outbound DNS and HTTP traffic to detect exfiltration or second-stage payload retrieval.
How to Mitigate CVE-2026-38165
Immediate Actions Required
- Inventory all applications using opensagres/xdocreport and identify versions between 0.9.2 and 2.2.0.
- Restrict access to any endpoint that accepts user-supplied templates or template variables until a patched release is deployed.
- Apply strict input validation to reject Velocity metacharacters such as #, $, and {} in fields that flow into report generation.
Patch Information
Monitor the XDocReport GitHub project and the referenced Pull Request #723 for a fixed release. Upgrade to a version later than 2.2.0 once available. The upstream fix constrains Velocity's uberspect to block reflective access to arbitrary Java classes.
Workarounds
- Configure Velocity with runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector to block reflection-based escapes.
- Run the Java application under a Security Manager or seccomp/AppArmor profile that denies Runtime.exec and process creation.
- Move report generation to an isolated worker with no outbound network access and minimal filesystem privileges.
# Configuration example: harden Velocity in velocity.properties
runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector
runtime.references.strict=true
velocimacro.permissions.allow.inline.local.scope=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
