Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Published Oct 1, 2026
7.2
HIGHCVSS 3.1
Description
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
Affected products
-
- Version < 9.1.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Adfinis | Document-Merge-Service | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Oct 1, 2026 · SSVC 2.0.3
No EPSS score for this CVE.
References (3)
- https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0 x_refsource_MISC
- https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc x_refsource_CONFIRM
- https://github.com/advisories/GHSA-w47q-945m-q9pc Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0 | x_refsource_MISC | |
| https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc | x_refsource_CONFIRM | |
| https://github.com/advisories/GHSA-w47q-945m-q9pc | Advisory |
Change history (0)
No recorded changes yet.