CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
An authenticated administrator can inject arbitrary Velocity template syntax to execute remote code, manipulate data, and access sensitive information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12107?
CVE-2025-12107 is a high-severity code injection vulnerability in Wso2 Identity Server, published on 19 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax.
Successful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to significant security consequences, including remote code execution, manipulation of data, and unauthorized access to sensitive information.
Which versions are affected by CVE-2025-12107?
It affects 1 product.
Products include Wso2 Identity Server.
How do I fix CVE-2025-12107?
No fix has been published for CVE-2025-12107 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-12107 being exploited?
There is no known exploitation of CVE-2025-12107 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Identity Server
- CVE-2016-4311 Cross-site request forgery in n/a
- CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
- CVE-2016-4312 XML external entity in n/a
- CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
- CVE-2025-0663 Auth bypass in WSO2 Identity Server
Sources
Also known as GHSA-8v9w-wqxw-hp8g.