Critical RCE via Server-Side Template Injection in OpenSAGRES XDocReport

OpenSAGRES XDocReport contains a critical server-side template injection (SSTI) vulnerability, tracked as CVE-2026-38165, affecting the Apache Velocity engine integration. The flaw exists because the application fails to perform adequate input validation or filtering when rendering content from uploaded .docx files. An attacker can craft a malicious .docx document containing Velocity template expressions and upload it to an application that utilizes XDocReport for document processing. When the server processes the document, the malicious expressions are executed, leading to remote code execution (RCE) with the privileges of the web application service. This vulnerability poses a severe risk to any organization that accepts user-provided .docx files for server-side template processing, potentially resulting in full system compromise, sensitive data exfiltration, and unauthorized access to backend resources.

Attack Chain

1. The attacker identifies an application that utilizes OpenSAGRES XDocReport for processing or rendering .docx files.
2. The attacker crafts a malicious .docx document that incorporates Apache Velocity template syntax designed to execute system commands.
3. The attacker navigates to the target application's file upload interface.
4. The attacker uploads the weaponized .docx file to the application.
5. The application triggers the XDocReport process to handle the document rendering.
6. The Apache Velocity engine parses the embedded malicious template expressions without sanitization.
7. The engine executes the injected expressions in the context of the server-side process, achieving remote code execution.

Impact

Successful exploitation of CVE-2026-38165 allows for unauthenticated remote code execution on the target server. This enables attackers to steal sensitive information, execute illegal system commands, modify or delete critical application files, and potentially gain full control over the host infrastructure. The vulnerability is rated with a CVSS score of 9.8, reflecting its high potential for total system compromise in affected environments.

Recommendation

1. Identify all internal and external-facing applications utilizing the OpenSAGRES XDocReport library.
2. Implement strict file upload validation policies that reject files containing suspicious template syntax or perform sandboxed processing of user-supplied documents.
3. Monitor web server access logs for anomalous POST requests to document upload endpoints, specifically looking for payloads containing typical Velocity or Java-related keywords.
4. Coordinate with vendors and developers to ensure the XDocReport library is updated to the latest secure version once a patch becomes available.
5. Review application service account permissions to ensure the principle of least privilege is applied, minimizing the potential impact of a successful RCE.