FKIE_CVE-2026-31864

Vulnerability from fkie_nvd - Published: 2026-03-13 19:54 - Updated: 2026-03-18 13:09
Severity ?
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks.
References
security-advisories@github.comhttps://github.com/jumpserver/jumpserver/pull/16608Issue Tracking
security-advisories@github.comhttps://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wcPatch, Vendor Advisory
Impacted products
Vendor Product Version
fit2cloud jumpserver *
fit2cloud jumpserver *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD655DF8-C263-4EC3-91F9-BB374C2C7ACD",
              "versionEndExcluding": "3.10.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DA50E29-0D69-476A-A92C-2D48FF5E51B0",
              "versionEndExcluding": "4.10.16",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer\u0027s Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks."
    },
    {
      "lang": "es",
      "value": "JumpServer es un host basti\u00f3n de c\u00f3digo abierto y un sistema de auditor\u00eda de seguridad de operaci\u00f3n y mantenimiento. Existe una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor (SSTI) en la funcionalidad de carga de Applet y VirtualApp de JumpServer. Esta vulnerabilidad solo puede ser explotada por usuarios con privilegios administrativos (permisos de Gesti\u00f3n de Applets de Aplicaci\u00f3n o Gesti\u00f3n de Aplicaciones Virtuales). Los atacantes pueden explotar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario dentro del contenedor de JumpServer Core. La vulnerabilidad surge del uso inseguro del renderizado de plantillas Jinja2 al procesar archivos de configuraci\u00f3n YAML cargados por el usuario. Cuando un usuario carga un paquete ZIP de Applet o VirtualApp, el archivo manifest.yml se renderiza a trav\u00e9s de Jinja2 sin restricciones de sandbox, lo que permite ataques de inyecci\u00f3n de plantillas."
    }
  ],
  "id": "CVE-2026-31864",
  "lastModified": "2026-03-18T13:09:28.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-13T19:54:36.803",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jumpserver/jumpserver/pull/16608"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.