A critical remote code execution vulnerability in xdocreport versions 0.9.2 through 2.2.0 poses a severe risk of full system compromise.

This is a Server-Side Template Injection (SSTI) flaw within the Velocity template engine configuration. The vulnerability allows an unauthenticated attacker to inject crafted expressions that result in arbitrary code execution on the underlying host.

The CVSS score of 9.8 reflects the critical nature of this vulnerability, as it requires no authentication and allows for full system takeover. A successful exploit could lead to complete data exfiltration, unauthorized administrative access, and persistent backdoors, posing a catastrophic risk to organizational integrity and data confidentiality.

Immediate Action: Review the official project repository at https://github.com/opensagres/xdocreport to identify and apply the latest available version that addresses this SSTI flaw.

Proactive Monitoring: Monitor application logs for suspicious template expression patterns or unexpected system calls originating from the xdocreport module.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious payloads containing suspicious Velocity engine syntax or common Java-based injection patterns.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the critical severity and the availability of public proof-of-concept code, immediate attention is required. Administrators should verify their xdocreport version and upgrade to a secure release immediately to prevent unauthorized code execution.