D
ue to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/ | Vendor Advisory |
Configurations
History
19 Feb 2026, 19:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wso2 identity Server
Wso2 |
|
| CPE | cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* | |
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/ - Vendor Advisory |
19 Feb 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-19 10:16
Updated : 2026-02-19 19:56
NVD link : CVE-2025-12107
Mitre link : CVE-2025-12107
CVE.ORG link : CVE-2025-12107
JSON object : View
Products Affected
CWE
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine