What security risks are associated with allowing untrusted users to submit Velocity templates?

Because VTL can call arbitrary getter/setter methods on any Java object exposed into the context, and can reach classes like java.lang.Runtime if introspection isn't restricted, letting untrusted users upload or edit templates is a genuine remote code execution risk, not just a theoretical one.

This was formalized as CVE-2020-13936: applications on Velocity Engine versions up to 2.2 that allowed untrusted template uploads could let an attacker execute arbitrary Java code or system commands with the privileges of the running process. Version 2.3 responded by adding stricter default restrictions on which methods and properties templates can introspect.

Mitigations include upgrading past 2.2, configuring Velocity's SecureUberspector (or the newer permission-based introspection controls) to block access to dangerous classes, and, more fundamentally, treating "allow arbitrary users to submit template source" as something to avoid entirely unless the templates come from trusted, reviewed sources.