OpenOLAT versions prior to 19.1.31, 20.1.18, and 20.2.5 are vulnerable to remote code execution, allowing an authenticated attacker to execute system commands with the privileges of the Tomcat process.

This is an improper neutralization of special elements used in a template engine (CWE-1336). An authenticated user with the Author role can inject Velocity directives into reminder email templates, which are then evaluated server-side to execute arbitrary Java classes.

The ability to execute arbitrary operating system commands creates a critical security risk for the entire host environment. Given that the underlying service typically runs with elevated privileges in containerized deployments, successful exploitation could result in a complete system compromise, unauthorized data access, and the potential for lateral movement within the network. With a CVSS score of 8.8, this flaw represents a High severity risk that demands immediate attention to prevent full service takeover.

Immediate Action: Upgrade to OpenOLAT version 19.1.31, 20.1.18, 20.2.5, or later, as these releases contain the necessary security patches to neutralize the template injection vulnerability.

Proactive Monitoring: Review system and application logs for suspicious entries originating from the email reminder service or unusual outbound network connections from the Tomcat process.

Compensating Controls: Implement strict egress filtering on the application server to prevent unauthorized command-and-control communication in the event of a successful exploit.

Public Exploit Available: Unknown

The vulnerability in OpenOLAT presents a significant risk due to the potential for full server compromise via remote code execution. Organizations utilizing this platform must prioritize patching to the versions specified above to eliminate the injection vector. Given the ease with which an authenticated user can weaponize this template flaw, the upgrade should be treated as a high-priority maintenance task.