{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12894", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-22T12:14:04.768Z", "datePublished": "2026-08-31T12:14:12.124Z", "dateUpdated": "2026-09-03T18:34:23.776Z"}, "containers": {"cna": {"title": "Quarkus-qute: io.quarkus.qute.reflectionvalueresolver: quarkus:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "camel-quarkus-qute", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "camel-quarkus-qute-component", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "quarkus-qute", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "camel-quarkus-qute", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "camel-quarkus-qute-component", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quarkus-qute", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quarkus-qute", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "camel-quarkus-qute", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "camel-quarkus-qute-component", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "quarkus-qute", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:63302", "name": "RHSA-2026:63302", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12894", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491319", "name": "RHBZ#2491319", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-31T11:30:40.187Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "description": "Improper Neutralization of Special Elements Used in a Template Engine", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "workarounds": [{"lang": "en", "value": "Applications utilizing the Quarkus Qute template engine should ensure that untrusted input is not directly incorporated into template content. Restricting access to the application's template rendering functionality to trusted sources can reduce the attack surface."}], "timeline": [{"lang": "en", "time": "2026-05-07T17:10:27.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-31T11:30:40.187Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank icysun for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-03T18:34:23.776Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T14:32:37.234748Z", "id": "CVE-2026-12894", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T14:32:46.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-31T14:32:37.234748Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T14:32:42.486Z"}}], "cna": {"title": "Quarkus-qute: io.quarkus.qute.reflectionvalueresolver: quarkus:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine", "credits": [{"lang": "en", "value": "Red Hat would like to thank icysun for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "packageName": "camel-quarkus-qute", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "packageName": "camel-quarkus-qute-component", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "packageName": "quarkus-qute", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:camel_quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "packageName": "camel-quarkus-qute", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "packageName": "camel-quarkus-qute-component", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "packageName": "quarkus-qute", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus", "packageName": "quarkus-qute", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "camel-quarkus-qute", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "camel-quarkus-qute-component", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "quarkus-qute", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-07T17:10:27.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-31T11:30:40.187Z", "value": "Made public."}], "datePublic": "2026-08-31T11:30:40.187Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:63302", "name": "RHSA-2026:63302", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12894", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491319", "name": "RHBZ#2491319", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Applications utilizing the Quarkus Qute template engine should ensure that untrusted input is not directly incorporated into template content. Restricting access to the application's template rendering functionality to trusted sources can reduce the attack surface."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-03T18:34:23.776Z"}, "x_redhatCweChain": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}}, "cveMetadata": {"cveId": "CVE-2026-12894", "state": "PUBLISHED", "dateUpdated": "2026-09-03T18:34:23.776Z", "dateReserved": "2026-06-22T12:14:04.768Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-31T12:14:12.124Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "defaultStatus": "unaffected", "packageName": "camel-quarkus-qute", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "defaultStatus": "unaffected", "packageName": "camel-quarkus-qute-component", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "defaultStatus": "unaffected", "packageName": "quarkus-qute", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_quarkus:3"], "defaultStatus": "affected", "packageName": "camel-quarkus-qute", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_quarkus:3"], "defaultStatus": "affected", "packageName": "camel-quarkus-qute-component", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_quarkus:3"], "defaultStatus": "affected", "packageName": "quarkus-qute", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3"], "defaultStatus": "affected", "packageName": "quarkus-qute", "product": "Red Hat build of Quarkus", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "camel-quarkus-qute", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "camel-quarkus-qute-component", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "quarkus-qute", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands."}], "id": "CVE-2026-12894", "lastModified": "2026-09-03T19:17:26.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12894", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T14:32:37.234748Z", "version": "2.0.3"}}]}, "published": "2026-08-31T13:17:20.753", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:63302"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-12894"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491319"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank icysun for reporting this issue.", "bugzilla": {"description": "quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine", "id": "2491319", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491319"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1336", "details": ["A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands."], "mitigation": {"lang": "en:us", "value": "Applications utilizing the Quarkus Qute template engine should ensure that untrusted input is not directly incorporated into template content. Restricting access to the application's template rendering functionality to trusted sources can reduce the attack surface."}, "name": "CVE-2026-12894", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "camel-quarkus-qute", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "camel-quarkus-qute-component", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "quarkus-qute", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "quarkus-qute", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "camel-quarkus-qute", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "camel-quarkus-qute-component", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "quarkus-qute", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-08-31T11:30:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12894\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12894"], "statement": "This is an Important server-side template injection vulnerability in the Quarkus Qute template engine. An attacker with the ability to supply or modify template content can bypass security filters designed to restrict access to sensitive Java methods. This bypass allows for arbitrary remote code execution within the context of the Java process, leading to a complete compromise of the affected application.", "threat_severity": "Important"}