Velocity Directive Injection in OpenOlat E-Learning Platform by OpenOLAT

CVE-2026-28228

What is CVE-2026-28228?

OpenOlat, the open-source web-based e-learning platform, contains a vulnerability where authenticated users with Author roles can inject Velocity directives into reminder email templates. This vulnerability can be exploited when the reminder email is processed, enabling an attacker to evaluate injected directives on the server side. By utilizing Velocity's #set directive alongside Java reflection, an attacker could instantiate arbitrary Java classes like java.lang.ProcessBuilder, allowing for system command execution with the privileges of the Tomcat process. The flaw has been addressed in updated versions 19.1.31, 20.1.18, and 20.2.5.

References