The vulnerability is a Server‑Side Template Injection in Velocity templates that allows an authenticated user with the Author role to inject directives, leading to arbitrary code execution on the server. This flaw, identified as CWE‑1336, permits a malicious actor to instantiate Java classes such as java.lang.ProcessBuilder and run operating system commands with the privileges of the Tomcat process, potentially compromising the entire platform.

The affected product is OpenOLAT, before versions 19.1.31, 20.1.18, and 20.2.5. Users running these older releases are exposed to the risk if reminder email templates can be edited by Authors.

With a CVSS score of 8.8 the severity is high, yet the EPSS score is below 1 %, indicating low current exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Author role and manipulation of reminder email templates, which may be triggered manually or via a daily cron job; afterward, the injected Velocity directives are evaluated server‑side, enabling remote code execution.