CVE-2025-12107

HIGH

8.4

Description

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.

CVE Details

CVSS v3.1 Score8.4

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published2/19/2026

Last Modified3/6/2026

Sourcenvd

Honeypot Sightings0

Affected Products

wso2:identity_server

Weaknesses (CWE)

CWE-1336

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/(ed10eef1-636d-4fbe-9993-6890dfa878f8)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.