CVE-2026-45618

What it actually does

This vulnerability allows remote code execution through crafted templates. At a technical level, an attacker who can submit, edit, upload, or influence template content can cause the template engine or rendering component to evaluate attacker-controlled expressions as executable code rather than treating them as data. Successful exploitation can allow command execution, file access, process spawning, credential theft from environment variables or configuration files, and potentially full compromise of the application runtime with the privileges of the affected service. The CVSS score of 10.0 indicates maximum severity, but no affected products or fixed versions were provided, so exposure must be validated against vendor-specific advisories and the actual templating components in use.

Why it matters to the business

If exploited, this flaw can let an attacker take control of affected application servers, disrupt services, steal sensitive data, modify business records, deploy malware, or pivot deeper into the network. Because the issue is unauthenticated or low-friction in many template-injection scenarios and is rated critical, organizations should treat any internet-facing system that accepts or renders user-controlled templates as high risk even though it is not currently listed in CISA KEV and no exploit maturity has been reported. The vulnerability has been public for 74 days, increasing the likelihood that proof-of-concept exploitation or opportunistic scanning may emerge.

How an attack unfolds

An attacker first identifies an application feature that renders templates, such as email templates, document generation, report builders, notification customization, CMS themes, import/export layouts, or preview functionality. They then submit harmless probe strings that reveal whether the template engine evaluates expressions. If evaluation occurs, the attacker refines the payload to access built-in objects, runtime helpers, reflection features, or sandbox escape primitives. Once code execution is achieved, the attacker typically runs reconnaissance commands, reads configuration and secrets, drops a web shell or persistent payload, and uses the compromised application identity to access databases, cloud services, or internal systems. Because no named threat actors or confirmed exploitation are provided, defenders should focus on generic server-side template injection and post-exploitation behaviors.

How to fix it

Apply the vendor-provided fixed version as soon as it is available for the affected product or component. Because no affected products or fixed versions were supplied, immediately inventory applications that allow user-controlled templates or server-side template rendering and consult the relevant vendor advisories. Where patching is not yet possible, disable template upload/edit/render features for untrusted users, restrict template editing to trusted administrators, enforce strict allowlists for template syntax, enable sandboxing with dangerous functions removed, block access to reflection/runtime/process APIs, and ensure templates cannot access environment variables, filesystem paths, network calls, or application secrets. Run affected services with least-privilege accounts, isolate them from sensitive internal systems, rotate credentials that may have been exposed, and place compensating controls such as WAF rules, request validation, and runtime command-execution monitoring around exposed endpoints.

How to confirm the fix worked

Confirm remediation by verifying the installed product or library version against the vendor’s fixed release once available. Review all application features that render templates and test that untrusted template expressions are not evaluated as code. Validate that template sandboxing is enabled, dangerous helpers are disabled, and the runtime service account cannot spawn shells, write to sensitive directories, or read secrets unnecessarily. For externally exposed applications, perform authenticated and unauthenticated testing of template entry points using safe non-executing probes that should render literally rather than evaluate. Confirm logs no longer show template parsing exceptions, expression evaluation errors, command execution attempts, or suspicious changes to stored templates after mitigation.

Typical attack path

1. Discover an exposed feature that accepts or stores template content.
2. Submit template-expression probes to determine whether input is evaluated during rendering.
3. Fingerprint the template engine or runtime based on errors, rendered output, or timing differences.
4. Craft a payload that escapes template sandboxing or reaches dangerous runtime functions.
5. Execute operating-system commands or application-runtime code under the service account.
6. Collect secrets, configuration files, tokens, and application data accessible to the compromised process.
7. Establish persistence through uploaded scripts, modified templates, scheduled tasks, startup hooks, or web shells.
8. Pivot to connected databases, internal services, cloud APIs, or other systems using stolen credentials.

How to detect it

To determine whether exploitation already occurred, review web access logs, application logs, template-rendering logs, error logs, audit logs for template creation or modification, process execution telemetry, EDR alerts, and file integrity monitoring. Look for requests containing template syntax, expression-language probes, sandbox escape attempts, references to runtime execution functions, or payloads that try to invoke shells and scripting interpreters. Investigate application errors mentioning template parsing, expression evaluation, undefined variables, reflection, sandbox violations, or denied access to runtime classes. Correlate suspicious requests with child processes spawned by the application server, unexpected outbound connections, new or modified template files, dropped scripts, web shells, cron jobs, scheduled tasks, or credential access. If exploitation is suspected, preserve volatile evidence, collect the affected templates and relevant logs, identify the application process user, review all files modified by that user, and rotate secrets available to the process.

• {{7*7}}
• ${7*7}
• <%= 7*7 %>
• #{7*7}
• {{config}}
• {{self}}
• {{request}}
• {{session}}
• {{.__class__}}
• __mro__
• __subclasses__
• __globals__
• __builtins__
• __import__
• os.popen
• subprocess.Popen
• Runtime.getRuntime
• java.lang.Runtime
• ProcessBuilder
• freemarker.template.utility.Execute
• ?new()
• T(java.lang.Runtime)
• constructor.constructor
• child_process
• require('child_process')
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• curl http
• wget http
• nc -e
• bash -c
• sh -c
• template parse error
• template rendering error
• sandbox violation
• expression evaluation failed

What your security team should do

• Prioritize discovery of internet-facing and partner-facing applications that support customizable templates, document generation, email formatting, reports, themes, or CMS-like content rendering.
• Monitor vendor advisories and package repositories for exact affected product names and fixed versions, then patch immediately when applicable.
• Temporarily disable or restrict untrusted template creation and editing until exposure is confirmed and remediated.
• Search historical logs for template-injection probes, rendering errors, command execution artifacts, and suspicious template modifications since at least the publication date.
• Add detection coverage for application processes spawning shells, scripting interpreters, network utilities, or package managers.
• Harden template engines by enforcing sandbox mode, removing dangerous functions, and using strict allowlists instead of blocklists.
• Run affected application services with least privilege and restrict outbound network access to reduce post-exploitation impact.
• Rotate credentials, API keys, and tokens accessible to any application suspected of exposure or compromise.