A server‑side template injection flaw in OpenOLAT's Velocity email templates allows an authenticated user with the Author role to inject arbitrary Velocity directives. By chaining the #set directive with Java reflection, the attacker can instantiate classes such as java.lang.ProcessBuilder and execute arbitrary operating system commands with the privileges of the servlet container process (often root in containerized deployments). This is a high‑severity vulnerability classified as CWE‑1336. The impact is full remote code execution, enabling complete compromise of the underlying hosting system.

The vulnerability affects the OpenOLAT e‑learning platform. Versions prior to 19.1.31, 20.1.18, and 20.2.5 are vulnerable. Users running any of these release lines are at risk unless they have applied the corresponding patches.

The flaw carries a CVSS score of 8.8, indicating a high risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. Nevertheless, exploitation requires an authenticated author user and access to the email template editor, making the attack vector a authenticated network attack. Once access is gained, the attacker can achieve complete system compromise.