CVE-2026-57853
Received Received - Intake

Server-Side Template Injection in DataGerry

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-57853
EUVD
EUVD-2026-117011

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DataGerry DataGerry 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57853 is a server-side template injection (SSTI) vulnerability in DataGerry versions before 3.3.0. Authenticated attackers with specific permissions can inject malicious Jinja2 payloads into templates via a POST request. When rendered, these payloads execute in an unsandboxed environment, allowing arbitrary OS command execution as the DataGerry web process user, which defaults to root in Docker deployments.

Detection Guidance

Check DataGerry versions prior to 3.3.0 for the SSTI vulnerability. Monitor HTTP requests to /rest/docapi/template endpoints for unauthorized POST requests with template_data payloads. Inspect logs for GET /rest/docapi/template/<id>/render/<object_id> requests that may execute malicious Jinja2 payloads.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server running DataGerry. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Since the web process runs as root by default in Docker, attackers gain high-privilege access.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access, potential data breaches, and lack of proper access controls. It undermines confidentiality and integrity requirements, risking regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade DataGerry to version 3.3.0 or later immediately. Remove or restrict the base.docapi.template.add permission for users. Disable or sandbox Jinja2 template rendering in DataGerry configurations. Monitor network traffic for suspicious requests to affected endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...