CVE-2026-53964
CVE-2026-53964 · Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
CVSS 7.2 · Élevée · EPSS 0,5% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
document-merge-service
- Versions du logiciel
- < 9.1.0: Concernée
Aucun correctif publié
document-merge-service PyPI
- Versions du logiciel
- 5.2.0
- 5.2.1
- 6.0.0
- 6.1.0
- 6.1.1
- 6.1.2
- 6.2.0
- 6.2.1
- 6.2.2
- 6.3.0
- 6.3.1
- 6.4.0
- 6.4.1
- 6.4.2
- 6.4.3
- 6.4.4
- 6.4.5
- 6.4.6
- 6.5.0
- 6.5.1
- 6.5.2
- 6.6.0
- 6.6.1
- 7.0.0
- 7.0.1
- 7.0.2
- 7.1.0
- 8.0.0
- 8.0.2
- 8.0.3
- 8.1.0
- 9.0.0
- Plages de versions concernées
- ECOSYSTEM: < 9.1.0
Mettez à jour vers 9.1.0