CVE-2026-28228 - Vulnerability Analysis

Overview

OpenOlat < 19.1.31, 20.1.18, 20.2.5 contains a command injection caused by injection of Velocity directives in reminder email templates, letting authenticated Author users execute OS commands with Tomcat process privileges, exploit requires Author role.

Severity & Score

Impact

Authenticated Author users can execute arbitrary OS commands with Tomcat process privileges, potentially leading to full system compromise.

Mitigation

Update to versions 19.1.31, 20.1.18, or 20.2.5 or later.

References

• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-55qg-vvgj-ffh4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner