A Remote Code Execution vulnerability in Velocity macro. By navigating pre-instantiated objects in the Velocity context, the sandbox blacklist is entirely bypassed.