Floci API Gateway VTL Template Injection RCE via ProcessBuilder and IAM Scope Bypass

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.