p PatchFirst

CVE-2024-37301

CVE-2024-37301 · document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.

CVSS 7.2 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • document-merge-service

    Versions
    • < 6.5.2: Affected

    No fix published

  • document-merge-service PyPI

    Versions
    • 5.2.0
    • 5.2.1
    • 6.0.0
    • 6.1.0
    • 6.1.1
    • 6.1.2
    • 6.2.0
    • 6.2.1
    • 6.2.2
    • 6.3.0
    • 6.3.1
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.4.3
    • 6.4.4
    • 6.4.5
    • 6.4.6
    • 6.5.0
    • 6.5.1
    Affected ranges
    • ECOSYSTEM: < 6.5.2

    Update to 6.5.2

Original sources

Check your server →