The flaw in Floci’s VtlTemplateEngine allows an attacker to inject arbitrary Velocity template code via an API Gateway mapping template. By using the $util object for Java reflection, the attacker can instantiate Runtime or ProcessBuilder within the Floci JVM, giving them the ability to execute OS commands. This is a classic code‑injection flaw (CWE‑94) that can lead to full compromise of the host system if the Floci service is exposed.

The affected product is Floci from floci‑io. All releases prior to 2.2.0, specifically the 1.1.0 series up to the immediately preceding 2.1.x releases, contain the vulnerable VtlTemplateEngine implementation. Any installation of these versions that accepts user‑supplied API Gateway VTL mapping templates is susceptible.

The CVSS score of 9.3 indicates a high‑severity exploit potential. Although no EPSS score is available, the exploit requires no special prerequisites: an unauthenticated attacker can craft a REST API with a MOCK integration and submit a malicious VTL template. The lack of authentication means any user with API access could trigger the vulnerability. The flaw is not listed in CISA’s known exploited vulnerabilities catalog, but its severity and the open nature of the exploitation path mean that enterprise environments should treat it as a critical risk.