PT-2026-25363 · Fit2Cloud+2 · Jumpserver

Sourbyte05 · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-31864

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JumpServer (affected versions not specified)

Description JumpServer is a bastion host and operation and maintenance security audit system. A Server-Side Template Injection (SSTI) issue exists in the Applet and VirtualApp upload functionality. This can be exploited by users with administrative privileges, specifically those with Application Applet Management or Virtual Application Management permissions. Successful exploitation allows attackers to execute arbitrary code within the JumpServer Core container. The root cause is the unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is processed through Jinja2 without sandbox restrictions, enabling template injection attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

CVE-2026-31864

GHSA-QX8H-RX2J-J5WC

Produtos afetados

Jumpserver

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31864.json · Exploit
• https://github.com/jumpserver/jumpserver/pull/16608 · Nota
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31864 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-31864 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605889471902049 · Publicação no Twitter