CVE-2020-13936

8.8 highEPSS 23%

High (8.8). EPSS 23% chance of exploitation in the next 30 days. Fixed in org.apache.velocity:velocity-engine-parent 2.3.

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 23% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
Published: 2021-03-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:velocity_engine
apache:wss4j
debian:debian_linux
oracle:banking_deposits_and_lines_of_credit_servicing
oracle:banking_enterprise_default_management
oracle:banking_loans_servicing
oracle:banking_party_management
oracle:banking_platform
oracle:communications_cloud_native_core_policy
oracle:communications_network_integrity
oracle:hospitality_token_proxy_service
oracle:retail_integration_bus
oracle:retail_order_broker
oracle:retail_service_backbone
oracle:retail_xstore_office_cloud_service
oracle:utilities_testing_accelerator

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-59j4-wjwp-mw9m	Maven	org.apache.velocity:velocity-engine-parent	<2.3	2.3
GHSA-59j4-wjwp-mw9m	Maven	org.apache.velocity:velocity	<=1.7	no fix published

References

Check your stack JSON