{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12107", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-10-23T11:28:43.355Z", "datePublished": "2026-02-19T10:04:47.542Z", "dateUpdated": "2026-09-03T13:25:20.318Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-09-03T13:25:20.318Z"}, "title": "Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in OS Commands ('OS Command Injection')", "type": "CWE"}, {"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 CAPEC-10: Injection"}]}, {"capecId": "CAPEC-260", "descriptions": [{"lang": "en", "value": "CAPEC-260 CAPEC-260: Server-Side Injection"}]}], "affected": [{"vendor": "WSO2", "product": "Identity Server", "versions": [{"status": "unaffected", "version": "0", "lessThan": "5.11.0", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.299", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.140", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.122", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "5.11.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.0", "versionEndExcluding": "5.11.0.299"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.0.140"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.0.122"}]}]}], "descriptions": [{"lang": "en", "value": "The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax.\n\nSuccessful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to significant security consequences, including remote code execution, manipulation of data, and unauthorized access to sensitive information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax.\n\nSuccessful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to significant security consequences, including remote code execution, manipulation of data, and unauthorized access to sensitive information."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution</span></a> <br>"}]}], "credits": [{"lang": "en", "value": "Robert C. Raducioiu", "type": "finder"}], "source": {"advisory": "WSO2-2025-4517", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T20:41:43.252367Z", "id": "CVE-2025-12107", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:41:56.623Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12107", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-20T20:41:43.252367Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:41:51.440Z"}}], "cna": {"title": "Potential authenticated Server-Side Template Injection (SSTI) vulnerability.", "source": {"advisory": "WSO2-2025-4517", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Robert Raducioiu"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "5.11.0.130", "lessThan": "5.11.0.299", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. \n\n Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.", "supportingMedia": [{"type": "text/html", "value": "Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. <br><br> Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.0.299", "versionStartIncluding": "5.11.0.130"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-03-06T15:29:19.426Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12107", "state": "PUBLISHED", "dateUpdated": "2026-03-06T15:29:19.426Z", "dateReserved": "2025-10-23T11:28:43.355Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-02-19T10:04:47.542Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.11.0", "status": "unaffected", "version": "0", "versionType": "custom"}, {"lessThan": "5.11.0.299", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.140", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.122", "status": "affected", "version": "6.1.0", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax.\n\nSuccessful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to significant security consequences, including remote code execution, manipulation of data, and unauthorized access to sensitive information."}, {"lang": "es", "value": "Debido al uso de un motor de plantillas Velocity de terceros vulnerable, un actor malicioso con privilegios de administrador puede inyectar y ejecutar sintaxis de plantilla arbitraria dentro de plantillas del lado del servidor.\n\nLa explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir a un actor malicioso con privilegios de administrador inyectar y ejecutar c\u00f3digo de plantilla arbitrario en el servidor, lo que podr\u00eda llevar a la ejecuci\u00f3n remota de c\u00f3digo, manipulaci\u00f3n de datos o acceso no autorizado a informaci\u00f3n sensible."}], "id": "CVE-2025-12107", "lastModified": "2026-09-03T14:17:00.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12107", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T20:41:43.252367Z", "version": "2.0.3"}}]}, "published": "2026-02-19T10:16:09.967", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": ["Vendor Advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-94"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"created": "2026-02-19T14:37:55.106576+00:00", "updated": "2026-02-19T14:37:55.106684+00:00", "vendors": ["wso2", "wso2$PRODUCT$identity_server"]}