Common Weakness Enumeration
CWE-1336
AllowedImproper Neutralization of Special Elements Used in a Template Engine
Abstraction: Base · Status: Incomplete
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
495 vulnerabilities reference this CWE, most recent first.
CVE-2026-119144 (GCVE-0-2026-119144)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:58 – Updated: 2026-10-29 15:58
VLAI
EPSS
VEX
Title
Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
Summary
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.
Severity
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-frame… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.21.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.21.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.111.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.111.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.21.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.111.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alperr7"
},
{
"lang": "en",
"type": "reporter",
"value": "geo-chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "AarDG10"
},
{
"lang": "en",
"type": "remediation developer",
"value": "ankush"
},
{
"lang": "en",
"type": "reporter",
"value": "x6vrn"
},
{
"lang": "en",
"type": "reporter",
"value": "SaifSalah"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:58:22.718Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6pmg-vc6m-6wrr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr"
},
{
"name": "VulnCheck Advisory: Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields"
}
],
"title": "Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119144",
"datePublished": "2026-10-29T15:58:22.718Z",
"dateReserved": "2026-10-29T14:28:41.595Z",
"dateUpdated": "2026-10-29T15:58:22.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118803 (GCVE-0-2026-118803)
Vulnerability from cvelistv5 – Published: 2026-10-28 21:11 – Updated: 2026-10-29 20:26
VLAI
EPSS
VEX
Title
Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
Summary
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
Severity
7.5 (High)
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://bricksbuilder.io/release/bricks-2-4-4/ | release-notes |
| https://www.vulncheck.com/advisories/bricks-theme… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bricks | Bricks Theme |
Affected:
0 , < 2.4.4
(semver)
|
Date Public
2026-10-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Bricks Theme",
"vendor": "Bricks",
"versions": [
{
"lessThan": "2.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Omer Musaddaq"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author\u0027s user record, including the password hash, without authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:26:13.822Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://bricksbuilder.io/release/bricks-2-4-4/"
},
{
"name": "VulnCheck Advisory: Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bricks-theme-unauthenticated-dynamic-data-tag-injection-via-query-result"
}
],
"title": "Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118803",
"datePublished": "2026-10-28T21:11:32.437Z",
"dateReserved": "2026-10-28T21:10:52.339Z",
"dateUpdated": "2026-10-29T20:26:13.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115938 (GCVE-0-2026-115938)
Vulnerability from cvelistv5 – Published: 2026-10-23 21:58 – Updated: 2026-10-23 21:58
VLAI
EPSS
VEX
Title
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
Summary
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Severity
CWE
- CWE-1336 - Improper neutralization of special elements used in a template engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-DRNL9W | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.11.2 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "4.18.9",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18.9",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohamed Wagdy (@Kalawy)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCraft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed\u0026nbsp;\u003ccode\u003ecolumn\u003c/code\u003e\u0026nbsp;filter delegates property lookup to Yii\u0026nbsp;\u003ccode\u003eArrayHelper\u003c/code\u003e, outside Twig\u2019s\u0026nbsp;\u003ccode\u003eSecurityPolicy\u003c/code\u003e. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\u003c/p\u003e\u003cp\u003eThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID\u0026nbsp;\u003ccode\u003e1\u003c/code\u003e\u0026nbsp;when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\u003c/p\u003e\u003cp\u003eAfter recovering\u0026nbsp;\u003ccode\u003eGeneralConfig::securityKey\u003c/code\u003e, the same user can compute Craft\u2019s generic HMAC wire format offline. Signed parameters such as\u0026nbsp;\u003ccode\u003eredirect\u003c/code\u003e\u0026nbsp;are then accepted and passed to unsandboxed\u0026nbsp;\u003ccode\u003eView::renderObjectTemplate()\u003c/code\u003e, where Twig\u2019s string-callable form can invoke native PHP callables. The regression proof uses the harmless\u0026nbsp;\u003ccode\u003esubstr()\u003c/code\u003e\u0026nbsp;callback and observes\u0026nbsp;\u003ccode\u003eabcdef\u003c/code\u003e\u0026nbsp;becoming\u0026nbsp;\u003ccode\u003ecdef\u003c/code\u003e; it does not execute an OS command.\u003c/p\u003e"
}
],
"value": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed\u00a0column\u00a0filter delegates property lookup to Yii\u00a0ArrayHelper, outside Twig\u2019s\u00a0SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID\u00a01\u00a0when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering\u00a0GeneralConfig::securityKey, the same user can compute Craft\u2019s generic HMAC wire format offline. Signed parameters such as\u00a0redirect\u00a0are then accepted and passed to unsandboxed\u00a0View::renderObjectTemplate(), where Twig\u2019s string-callable form can invoke native PHP callables. The regression proof uses the harmless\u00a0substr()\u00a0callback and observes\u00a0abcdef\u00a0becoming\u00a0cdef; it does not execute an OS command."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper neutralization of special elements used in a template engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:58:51.816Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-DRNL9W"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.11.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6"
}
],
"source": {
"advisory": "GHSA-v4q3-2g5g-wjj6",
"discovery": "UNKNOWN"
},
"title": "Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-115938",
"datePublished": "2026-10-23T21:58:51.816Z",
"dateReserved": "2026-10-23T21:25:32.945Z",
"dateUpdated": "2026-10-23T21:58:51.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115189 (GCVE-0-2026-115189)
Vulnerability from cvelistv5 – Published: 2026-10-26 12:39 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Summary
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:47 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:47:38.169849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:53.698Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"versions": [
{
"lessThan": "5.2.12",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
},
{
"lessThan": "6.0.10",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThan": "7.2.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AbisheikMagesh (@amagesh1)"
},
{
"lang": "en",
"type": "finder",
"value": "Jace (@manus-use)"
},
{
"lang": "en",
"type": "finder",
"value": "@sec-reex"
},
{
"lang": "en",
"type": "finder",
"value": "Ghost (@prakhar0x01)"
},
{
"lang": "en",
"type": "finder",
"value": "Aleksei Ivanov (@lostfany)"
},
{
"lang": "en",
"type": "finder",
"value": "trung (@trungpv19)"
},
{
"lang": "en",
"type": "finder",
"value": "Submersion AI - Security Research Team (SRT) (@SRTSubmersionAI)"
},
{
"lang": "en",
"type": "finder",
"value": "Abdullah Kareem (@CyberKareem)"
},
{
"lang": "en",
"type": "finder",
"value": "Moath Aloufi (@m0xath)"
},
{
"lang": "en",
"type": "finder",
"value": "@Forrof"
},
{
"lang": "en",
"type": "finder",
"value": "@cxcsec"
},
{
"lang": "en",
"type": "finder",
"value": "Lucas Dodgson (@lucasdodgson)"
},
{
"lang": "en",
"type": "finder",
"value": "@FlowOverFail"
},
{
"lang": "en",
"type": "finder",
"value": "@tal2k9dev-star"
},
{
"lang": "en",
"type": "finder",
"value": "Tal Lavi (@tlavi00)"
},
{
"lang": "en",
"type": "analyst",
"value": "@Den1al"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka (@patrykgruszka)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart (@escopecz)"
},
{
"lang": "en",
"type": "sponsor",
"value": "Leuchtfeuer Digital Marketing (@Leuchtfeuer)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg."
}
],
"value": "A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T12:39:14.432Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-h7pm-79gc-8867"
}
],
"source": {
"advisory": "GHSA-h7pm-79gc-8867",
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "There are no official workarounds. To mitigate this vulnerability without upgrading, restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation to operator-level roles."
}
],
"value": "There are no official workarounds. To mitigate this vulnerability without upgrading, restrict the core:themes:create permission to trusted administrator accounts only and do not delegate theme creation to operator-level roles."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2026-115189",
"datePublished": "2026-10-26T12:39:14.432Z",
"dateReserved": "2026-10-22T06:39:15.178Z",
"dateUpdated": "2026-10-26T15:35:53.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110593 (GCVE-0-2026-110593)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-16 11:38
VLAI
EPSS
VEX
Title
BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
Summary
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:49 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Django-CRM/Django-CRM/issues/826 | issue-tracking |
| https://github.com/Django-CRM/Django-CRM/blob/v1.… | technical-description |
| https://github.com/aaronamran/CVE-Disclosures/tre… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/bottlecrm-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MicroPyramid | BottleCRM |
Affected:
0 , ≤ 1.14.5
(custom)
cpe:2.3:a:micropyramid:django_crm:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110593",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:49:35.719644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:54:56.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/django-crm",
"product": "BottleCRM",
"repo": "https://github.com/Django-CRM/Django-CRM",
"vendor": "MicroPyramid",
"versions": [
{
"lessThanOrEqual": "1.14.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:micropyramid:django_crm:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Amran Bin Amiruddin (@aaronamran)"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/\u003cid\u003e/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T11:38:59.795Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Django-CRM/Django-CRM/issues/826"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/accounts/tasks.py#L45"
},
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110593"
},
{
"name": "VulnCheck Advisory: BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bottlecrm-through-1.14.5-server-side-template-injection-via-account-email-create-mail"
}
],
"title": "BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110593",
"datePublished": "2026-10-14T14:16:37.842Z",
"dateReserved": "2026-10-14T13:07:17.919Z",
"dateUpdated": "2026-10-16T11:38:59.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109652 (GCVE-0-2026-109652)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:34
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
Summary
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 12:30 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T12:30:43.392616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T12:34:25.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.119.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.32.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.119.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.119.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.32.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
},
{
"lang": "en",
"type": "reporter",
"value": "mtholmquist"
},
{
"lang": "en",
"type": "reporter",
"value": "vnth4nhnt"
},
{
"lang": "en",
"type": "reporter",
"value": "bugbunny-research"
},
{
"lang": "en",
"type": "reporter",
"value": "lukasz-rybak"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:23.915Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6w83-8777-v93q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-6w83-8777-v93q"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-server-side-template-injection-via-message-fields"
}
],
"title": "Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109652",
"datePublished": "2026-10-12T22:22:23.915Z",
"dateReserved": "2026-10-12T21:06:47.173Z",
"dateUpdated": "2026-10-14T12:34:25.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109305 (GCVE-0-2026-109305)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-13 18:05
VLAI
EPSS
VEX
Title
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
Summary
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:05 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/craftcms/cms/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/craft-cms-5.… | third-party-advisory |
Impacted products
Date Public
2026-09-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:05:49.788324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:05:59.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.14",
"status": "affected",
"version": "5.10.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.14",
"versionStartIncluding": "5.10.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dee-see"
}
],
"datePublic": "2026-09-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:01.545Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vfcw-xv8p-8rj2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-vfcw-xv8p-8rj2"
},
{
"name": "VulnCheck Advisory: Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/craft-cms-5.10.2-before-5.10.14-twig-sandbox-bypass-rce-via-has-some-has-every"
}
],
"title": "Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109305",
"datePublished": "2026-10-12T16:05:01.545Z",
"dateReserved": "2026-10-12T14:13:39.027Z",
"dateUpdated": "2026-10-13T18:05:59.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108570 (GCVE-0-2026-108570)
Vulnerability from cvelistv5 – Published: 2026-10-11 10:30 – Updated: 2026-10-13 13:02
VLAI
EPSS
VEX
Title
Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine
Summary
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:02 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416227 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416227/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108570 | third-party-advisory |
| https://vuldb.com/submit/954714 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Furion | .NET Framework |
Affected:
4.9.9.0
Affected: 4.9.9.1 Affected: 4.9.9.2 Affected: 4.9.9.3 Affected: 4.9.9.4 Affected: 4.9.9.5 Affected: 4.9.9.6 Affected: 4.9.9.7 Affected: 4.9.9.8 Affected: 4.9.9.9 Affected: 4.9.9.10 Affected: 4.9.9.11 Affected: 4.9.9.12 Affected: 4.9.9.13 Affected: 4.9.9.14 Affected: 4.9.9.15 Affected: 4.9.9.16 Affected: 4.9.9.17 Affected: 4.9.9.18 Affected: 4.9.9.19 Affected: 4.9.9.20 Affected: 4.9.9.21 Affected: 4.9.9.22 Affected: 4.9.9.23 Affected: 4.9.9.24 Affected: 4.9.9.25 Affected: 4.9.9.26 Affected: 4.9.9.27 Affected: 4.9.9.28 Affected: 4.9.9.29 Affected: 4.9.9.30 Affected: 4.9.9.31 Affected: 4.9.9.32 Affected: 4.9.9.33 Affected: 4.9.9.34 Affected: 4.9.9.35 Affected: 4.9.9.36 Affected: 4.9.9.37 Affected: 4.9.9.38 Affected: 4.9.9.39 Affected: 4.9.9.40 Affected: 4.9.9.41 Affected: 4.9.9.42 Affected: 4.9.9.43 Affected: 4.9.9.44 Affected: 4.9.9.45 Affected: 4.9.9.46 Affected: 4.9.9.47 Affected: 4.9.9.48 Affected: 4.9.9.49 Affected: 4.9.9.50 Affected: 4.9.9.51 Affected: 4.9.9.52 Affected: 4.9.9.53 Affected: 4.9.9.54 Affected: 4.9.9.55 Affected: 4.9.9.56 Affected: 4.9.9.57 Affected: 4.9.9.58 Affected: 4.9.9.59 Affected: 4.9.9.60 Affected: 4.9.9.61 Affected: 4.9.9.62 Affected: 4.9.9.63 Affected: 4.9.9.64 Affected: 4.9.9.65 Affected: 4.9.9.66 Affected: 4.9.9.67 Affected: 4.9.9.68 Affected: 4.9.9.69 Affected: 4.9.9.70 Affected: 4.9.9.71 Affected: 4.9.9.72 Affected: 4.9.9.73 Affected: 4.9.9.74 Affected: 4.9.9.75 Affected: 4.9.9.76 Affected: 4.9.9.77 Affected: 4.9.9.78 Affected: 4.9.9.79 Affected: 4.9.9.80 Affected: 4.9.9.81 Affected: 4.9.9.82 Affected: 4.9.9.83 Affected: 4.9.9.84 Affected: 4.9.9.85 Affected: 4.9.9.86 Affected: 4.9.9.87 Affected: 4.9.9.88 Affected: 4.9.9.89 Affected: 4.9.9.90 Affected: 4.9.9.91 Affected: 4.9.9.92 Affected: 4.9.9.93 Affected: 4.9.9.94 Affected: 4.9.9.95 cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108570",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:02:01.242393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:02:30.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/954714"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:*"
],
"modules": [
"View Engine"
],
"product": ".NET Framework",
"vendor": "Furion",
"versions": [
{
"status": "affected",
"version": "4.9.9.0"
},
{
"status": "affected",
"version": "4.9.9.1"
},
{
"status": "affected",
"version": "4.9.9.2"
},
{
"status": "affected",
"version": "4.9.9.3"
},
{
"status": "affected",
"version": "4.9.9.4"
},
{
"status": "affected",
"version": "4.9.9.5"
},
{
"status": "affected",
"version": "4.9.9.6"
},
{
"status": "affected",
"version": "4.9.9.7"
},
{
"status": "affected",
"version": "4.9.9.8"
},
{
"status": "affected",
"version": "4.9.9.9"
},
{
"status": "affected",
"version": "4.9.9.10"
},
{
"status": "affected",
"version": "4.9.9.11"
},
{
"status": "affected",
"version": "4.9.9.12"
},
{
"status": "affected",
"version": "4.9.9.13"
},
{
"status": "affected",
"version": "4.9.9.14"
},
{
"status": "affected",
"version": "4.9.9.15"
},
{
"status": "affected",
"version": "4.9.9.16"
},
{
"status": "affected",
"version": "4.9.9.17"
},
{
"status": "affected",
"version": "4.9.9.18"
},
{
"status": "affected",
"version": "4.9.9.19"
},
{
"status": "affected",
"version": "4.9.9.20"
},
{
"status": "affected",
"version": "4.9.9.21"
},
{
"status": "affected",
"version": "4.9.9.22"
},
{
"status": "affected",
"version": "4.9.9.23"
},
{
"status": "affected",
"version": "4.9.9.24"
},
{
"status": "affected",
"version": "4.9.9.25"
},
{
"status": "affected",
"version": "4.9.9.26"
},
{
"status": "affected",
"version": "4.9.9.27"
},
{
"status": "affected",
"version": "4.9.9.28"
},
{
"status": "affected",
"version": "4.9.9.29"
},
{
"status": "affected",
"version": "4.9.9.30"
},
{
"status": "affected",
"version": "4.9.9.31"
},
{
"status": "affected",
"version": "4.9.9.32"
},
{
"status": "affected",
"version": "4.9.9.33"
},
{
"status": "affected",
"version": "4.9.9.34"
},
{
"status": "affected",
"version": "4.9.9.35"
},
{
"status": "affected",
"version": "4.9.9.36"
},
{
"status": "affected",
"version": "4.9.9.37"
},
{
"status": "affected",
"version": "4.9.9.38"
},
{
"status": "affected",
"version": "4.9.9.39"
},
{
"status": "affected",
"version": "4.9.9.40"
},
{
"status": "affected",
"version": "4.9.9.41"
},
{
"status": "affected",
"version": "4.9.9.42"
},
{
"status": "affected",
"version": "4.9.9.43"
},
{
"status": "affected",
"version": "4.9.9.44"
},
{
"status": "affected",
"version": "4.9.9.45"
},
{
"status": "affected",
"version": "4.9.9.46"
},
{
"status": "affected",
"version": "4.9.9.47"
},
{
"status": "affected",
"version": "4.9.9.48"
},
{
"status": "affected",
"version": "4.9.9.49"
},
{
"status": "affected",
"version": "4.9.9.50"
},
{
"status": "affected",
"version": "4.9.9.51"
},
{
"status": "affected",
"version": "4.9.9.52"
},
{
"status": "affected",
"version": "4.9.9.53"
},
{
"status": "affected",
"version": "4.9.9.54"
},
{
"status": "affected",
"version": "4.9.9.55"
},
{
"status": "affected",
"version": "4.9.9.56"
},
{
"status": "affected",
"version": "4.9.9.57"
},
{
"status": "affected",
"version": "4.9.9.58"
},
{
"status": "affected",
"version": "4.9.9.59"
},
{
"status": "affected",
"version": "4.9.9.60"
},
{
"status": "affected",
"version": "4.9.9.61"
},
{
"status": "affected",
"version": "4.9.9.62"
},
{
"status": "affected",
"version": "4.9.9.63"
},
{
"status": "affected",
"version": "4.9.9.64"
},
{
"status": "affected",
"version": "4.9.9.65"
},
{
"status": "affected",
"version": "4.9.9.66"
},
{
"status": "affected",
"version": "4.9.9.67"
},
{
"status": "affected",
"version": "4.9.9.68"
},
{
"status": "affected",
"version": "4.9.9.69"
},
{
"status": "affected",
"version": "4.9.9.70"
},
{
"status": "affected",
"version": "4.9.9.71"
},
{
"status": "affected",
"version": "4.9.9.72"
},
{
"status": "affected",
"version": "4.9.9.73"
},
{
"status": "affected",
"version": "4.9.9.74"
},
{
"status": "affected",
"version": "4.9.9.75"
},
{
"status": "affected",
"version": "4.9.9.76"
},
{
"status": "affected",
"version": "4.9.9.77"
},
{
"status": "affected",
"version": "4.9.9.78"
},
{
"status": "affected",
"version": "4.9.9.79"
},
{
"status": "affected",
"version": "4.9.9.80"
},
{
"status": "affected",
"version": "4.9.9.81"
},
{
"status": "affected",
"version": "4.9.9.82"
},
{
"status": "affected",
"version": "4.9.9.83"
},
{
"status": "affected",
"version": "4.9.9.84"
},
{
"status": "affected",
"version": "4.9.9.85"
},
{
"status": "affected",
"version": "4.9.9.86"
},
{
"status": "affected",
"version": "4.9.9.87"
},
{
"status": "affected",
"version": "4.9.9.88"
},
{
"status": "affected",
"version": "4.9.9.89"
},
{
"status": "affected",
"version": "4.9.9.90"
},
{
"status": "affected",
"version": "4.9.9.91"
},
{
"status": "affected",
"version": "4.9.9.92"
},
{
"status": "affected",
"version": "4.9.9.93"
},
{
"status": "affected",
"version": "4.9.9.94"
},
{
"status": "affected",
"version": "4.9.9.95"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "BlackSpdier (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T10:30:14.538Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416227 | Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416227"
},
{
"name": "VDB-416227 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416227/cti"
},
{
"name": "CVE-2026-108570 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108570"
},
{
"name": "Submit #954714 | \u767e\u7b7e\u79d1\u6280\uff08\u5e7f\u4e1c\uff09\u6709\u9650\u516c\u53f8 Furion v4 RCE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/954714"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-10T17:19:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108570",
"datePublished": "2026-10-11T10:30:14.538Z",
"dateReserved": "2026-10-10T15:14:25.303Z",
"dateUpdated": "2026-10-13T13:02:30.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108264 (GCVE-0-2026-108264)
Vulnerability from cvelistv5 – Published: 2026-10-09 20:52 – Updated: 2026-10-13 15:13
VLAI
EPSS
VEX
Title
Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)
Summary
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:13 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wizarrrr/wizarr/security/advis… | x_refsource_CONFIRM |
| https://github.com/wizarrrr/wizarr/commit/6aa3c33… | x_refsource_MISC |
| https://github.com/wizarrrr/wizarr/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108264",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:13:10.988706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:13:17.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wizarrrr/wizarr/security/advisories/GHSA-h9rv-mxh2-35f3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wizarr",
"vendor": "wizarrrr",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application\u0027s non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T20:52:19.351Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wizarrrr/wizarr/security/advisories/GHSA-h9rv-mxh2-35f3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wizarrrr/wizarr/security/advisories/GHSA-h9rv-mxh2-35f3"
},
{
"name": "https://github.com/wizarrrr/wizarr/commit/6aa3c33c1b3d945e055ef116cc531028b3735bb7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wizarrrr/wizarr/commit/6aa3c33c1b3d945e055ef116cc531028b3735bb7"
},
{
"name": "https://github.com/wizarrrr/wizarr/releases/tag/v2026.9.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wizarrrr/wizarr/releases/tag/v2026.9.1"
}
],
"source": {
"advisory": "GHSA-h9rv-mxh2-35f3",
"discovery": "UNKNOWN"
},
"title": "Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108264",
"datePublished": "2026-10-09T20:52:19.351Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T15:13:17.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107264 (GCVE-0-2026-107264)
Vulnerability from cvelistv5 – Published: 2026-10-30 03:10 – Updated: 2026-10-30 20:06
VLAI
EPSS
VEX
Title
Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203
Summary
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 20:06 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Inline Formatter Field |
Affected:
0.0.0 , < 4.2.0
(semver)
|
Date Public
2026-10-07 16:27
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T20:06:41.406412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:06:44.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/inline_formatter_field",
"product": "Inline Formatter Field",
"repo": "https://git.drupalcode.org/project/inline_formatter_field",
"vendor": "Drupal",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marcus Johansson (marcus_johansson)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bobby Saul (bobbysaul)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
}
],
"datePublic": "2026-10-07T16:27:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:10:12.569Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-203"
}
],
"title": "Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-107264",
"datePublished": "2026-10-30T03:10:12.569Z",
"dateReserved": "2026-10-07T15:25:19.995Z",
"dateUpdated": "2026-10-30T20:06:44.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
Mitigation
Implementation
Use the template engine's sandbox or restricted mode, if available.
No CAPEC attack patterns related to this CWE.