BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-57853DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.

8.7 HIGHEPSS 0.55%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
8.7HIGH4.0VulnCheck (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8HIGH3.1VulnCheck (CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID
CVE-2026-57853
Status
Received
Assigner (CNA)
VulnCheck
Published
Nov 4, 2026
Last modified
2026-11-05 19:17 UTC
Weaknesses
  • CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:29 UTC.