High DLA-2595-1 1 CVE

velocity - security update

Published Mar 17, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	velocity	1.7-5+deb9u1

Vulnerabilities 1

High 8.8

CVE-2020-13936 EPSS 23%

Velocity Sandbox Bypass

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…

Apache Software Foundation Apache Velocity Engine org.apache.velocity:velocity velocity Debian Ubuntu Maven

Mar 10, 2021