Flowise/floci API Gateway VTL Template Injection RCE (exploitarium)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects remote code execution (RCE) attempts targeting Flowise/floci API Gateway services through Velocity Template Language (VTL) server-side template injection. The rule monitors for malicious payload patterns involving Java class reflection (e.g., ProcessBuilder) and unauthorized access attempts through API Gateway endpoints, including potential IAM scope bypass signatures.