https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-53964 <p><strong>Affected:</strong> adfinis document-merge-service</p> <p>Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server&#39;s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.</p> <p><strong>Affected:</strong> adfinis document-merge-service</p> <p>Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server&#39;s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-53964 https://cve.radiocsirt.org/vuln/ghsa-w47q-945m-q9pc <p><strong>Affected:</strong> PyPI: document-merge-service</p> <p>### Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server&#39;s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the `xltpl` library uses a npn-sandboxed Jinja environment for the processing of the template.</p> <p>### Patches It has been patched in [v9.1.0](https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0)</p> <p>### Workarounds Disable the upload/usage of XLSX templates.</p> <p>### References Are there any links users can visit to find out more?</p> <p>https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti</p> <p><strong>Affected:</strong> PyPI: document-merge-service</p> <p>### Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server&#39;s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the `xltpl` library uses a npn-sandboxed Jinja environment for the processing of the template.</p> <p>### Patches It has been patched in [v9.1.0](https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0)</p> <p>### Workarounds Disable the upload/usage of XLSX templates.</p> <p>### References Are there any links users can visit to find out more?</p> <p>https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti</p> https://cve.radiocsirt.org/vuln/ghsa-w47q-945m-q9pc