Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine (Quarkus quarkus-qute)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.97 % · percentile 62 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Awaiting Analysis
Description
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Weaknesses (CWE)
- CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-68505
- GCVE · GCVE-0-2026-12894
Affected products
| Product | Versions |
|---|---|
| Quarkus · quarkus-qute | affected 3.27.0 < 3.27.5.SP1 ; affected 3.33.0 < 3.33.3.SP1 |
| Red Hat · Red Hat Build of Apache Camel 3.33.3.SP1 | unaffected 3.33.3.redhat-00005 < * |
| Red Hat · Red Hat build of Quarkus 3.27.5.SP1 | unaffected 3.27.5.redhat-00004 < * |
| Red Hat · Red Hat build of Quarkus 3.33.3.SP1 | unaffected 3.33.3.redhat-00005 < * |
| Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | |
| Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | |
| Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | |
| Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack | |
| Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack | |
| Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |