https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:59:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362158 EUVD-2026-362158 https://cve.radiocsirt.org/vuln/euvd-2026-362158 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22244 <p>OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.</p> <p>OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22244 https://cve.radiocsirt.org/vuln/ghsa-5f29-2333-h9c7 <p><strong>Affected:</strong> Maven: org.open-metadata:platform</p> <p># OpenMetadata RCE Vulnerability - Proof of Concept</p> <p>## Executive Summary</p> <p>**CRITICAL Remote Code Execution vulnerability** confirmed in OpenMetadata v1.11.2 via **Server-Side Template Injection (SSTI)** in FreeMarker email templates.</p> <p>## Credit - @lnlinh31, @satthusaosan, @TheMacCuoi, @get-wright, @Ohnooo1234, @hienduc14 – FPT Cloud AppSec Research Team, FPT Smart Cloud</p> <p>## Vulnerability Details</p> <p>### 1. Root Cause</p> <p>File: `openmetadata-service/src/main/java/org/openmetadata/service/util/DefaultTemplateProvider.java`</p> <p>**Lines 35-45** contain unsafe FreeMarker template instantiation:</p> <p>```java public Template getTemplate(String templateName) throws IOException { EmailTemplate emailTemplate = documentRepository.fetchEmailTemplateByName(templateName); String template = emailTemplate.getTemplate(); // ← USER-CONTROLLED CONTENT FROM DATABASE if (nullOrEmpty(template)) { throw new IOException(&#34;Template content not found for template: &#34; + templateName); } return new Template( templateName, new StringReader(template), // ← RENDERS UNTRUSTED TEMPLATE new Configuration(Configuration.VERSION_2_3_31)); // ← UNSAFE: NO SECURITY RESTRICTIONS! } ```</p> <p>**Missing Security Controls**: - ❌ No `setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER)` - Allows arbitrary class instantiation - ❌ No `setAPIBuiltinEnabled(false)` - Enables `?api` built-in for reflection - ❌ No input validation - Template content not sanitized</p> <p>###…</p> <p><strong>Affected:</strong> Maven: org.open-metadata:platform</p> <p># OpenMetadata RCE Vulnerability - Proof of Concept</p> <p>## Executive Summary</p> <p>**CRITICAL Remote Code Execution vulnerability** confirmed in OpenMetadata v1.11.2 via **Server-Side Template Injection (SSTI)** in FreeMarker email templates.</p> <p>## Credit - @lnlinh31, @satthusaosan, @TheMacCuoi, @get-wright, @Ohnooo1234, @hienduc14 – FPT Cloud AppSec Research Team, FPT Smart Cloud</p> <p>## Vulnerability Details</p> <p>### 1. Root Cause</p> <p>File: `openmetadata-service/src/main/java/org/openmetadata/service/util/DefaultTemplateProvider.java`</p> <p>**Lines 35-45** contain unsafe FreeMarker template instantiation:</p> <p>```java public Template getTemplate(String templateName) throws IOException { EmailTemplate emailTemplate = documentRepository.fetchEmailTemplateByName(templateName); String template = emailTemplate.getTemplate(); // ← USER-CONTROLLED CONTENT FROM DATABASE if (nullOrEmpty(template)) { throw new IOException(&#34;Template content not found for template: &#34; + templateName); } return new Template( templateName, new StringReader(template), // ← RENDERS UNTRUSTED TEMPLATE new Configuration(Configuration.VERSION_2_3_31)); // ← UNSAFE: NO SECURITY RESTRICTIONS! } ```</p> <p>**Missing Security Controls**: - ❌ No `setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER)` - Allows arbitrary class instantiation - ❌ No `setAPIBuiltinEnabled(false)` - Enables `?api` built-in for reflection - ❌ No input validation - Template content not sanitized</p> <p>###…</p> https://cve.radiocsirt.org/vuln/ghsa-5f29-2333-h9c7