CVE-2026-38165 opensagres CVE debrief

Who should care

Defenders responsible for xdocreport instances should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who oversee the use of xdocreport in their environments. They must verify their exposure, prioritize remediation efforts, and apply vendor-provided fixes to mitigate the risk associated with this vulnerability.

Why it matters

The SSTI vulnerability in xdocreport allows attackers to execute arbitrary code, posing a significant risk to defenders who use this software. Defenders should assess exposure, prioritize remediation, and verify affected versions and vendor fixes.

• Verify affected versions of xdocreport and assess exposure
• Prioritize remediation of vulnerable instances
• Monitor for potential exploitation attempts

Technical summary

The CVE record describes a Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport versions 0.9.2 to 2.2.0. An attacker can exploit this vulnerability to execute arbitrary code via a crafted expression. This vulnerability affects applications using xdocreport and allows attackers to gain control over the server. Defenders should focus on verifying exposure, prioritizing remediation, and applying vendor-provided fixes to mitigate the risk. The vulnerability is considered critical, with a CVSS score of 9.8.

Defensive priority

High

Recommended defensive actions

• Assess exposure of xdocreport instances to the SSTI vulnerability
• Prioritize remediation of affected xdocreport versions
• Verify vendor-provided fixes and update to a secure version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SSTI vulnerability in xdocreport. However, the corpus lacks specific information on affected versions, exploitation, and vendor remediation. Further verification is needed to confirm the scope of the vulnerability and ensure that appropriate mitigations are in place. The CVE record was published on 2026-08-17T23:16:51.230Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.