Résumé
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Détails de l’avis
Impact
A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template.
Patches
It has been patched in v9.1.0
Workarounds
Disable the upload/usage of XLSX templates.
References
Are there any links users can visit to find out more?
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-72807
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
- CRITICALCVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
- CRITICALCVE-2026-62682
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- CRITICALCVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
- CRITICALCVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
- CRITICALCVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal