FlawAtlas
Search the atlas
CVE-2020-13936 High

CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Exploit probability 22.7%
Published March 10, 2021
Required by Not available
Last source change April 16, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown
Maven org.apache.velocity:velocity

10 explicit affected versions

Maven org.apache.velocity:velocity-engine-parent

3 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

View original source
Open Source Vulnerabilities GHSA-59j4-wjwp-mw9m

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

View original source

05 / REFERENCES

Further evidence