CVE-2026-38165

The CVSS 9.8 score for CVE-2026-38165 should not be your primary decision driver. This is a Server-Side Template Injection vulnerability in xdocreport's Velocity engine integration, but xdocreport is a document generation library — it does not run as a standalone service with an exposed HTTP endpoint. The actual exploitation path requires a downstream application to pass unsanitized, user-controlled data into Velocity template evaluation within xdocreport. That is a specific integration mistake, not a universal exposure. The EPSS score of 0.00271 reflects mass exploitation probability — opportunistic scanning for vulnerable internet-facing instances. For a library vulnerability, this is the wrong threat model. What matters is targeted exploitation: if xdocreport is embedded in an HR system generating sensitive reports, a contract builder accepting user-provided templates, or any document pipeline handling personal or financial data, one successful exploit is a complete compromise regardless of how unlikely mass scanning is. The practical risk calculation hinges on whether any application in your environment actually exposes Velocity template rendering to untrusted input. Check this directly: examine where xdocreport is used in your stack and trace whether user-supplied data flows into any template rendering call. If xdocreport only processes pre-approved, internally-managed templates, the technical severity is largely academic. If it accepts template content from users — even indirectly through report builders, form converters, or dynamic document systems — treat this as a critical priority with an immediate patching path. The four-year version range (v0.9.2 through v2.2.0) matters because vulnerable versions have been compiled into shipped artifacts, embedded in proprietary applications, and pinned in transitive dependency trees. Applications locked to intermediate versions face compounding update friction — they must patch xdocreport while managing other dependency changes accumulated over that window. Document generation libraries tend to integrate deeply into build pipelines, and when they eventually get replaced rather than patched, the vulnerable versions persist in Maven caches, Docker layers, and dependency trees no one actively monitors.

Reviewed through automated stages and approved by a human before publication.