PT-2026-41572 · Xiandafu · Beetl

Pigpig · Published 2026-05-17 · Updated 2026-05-29 · CVE-2026-8759

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xiandafu beetl versions prior to 3.20.3

Description Improper neutralization of special elements in an expression language statement allows for remote exploitation. The issue exists within the SpELFunction component, specifically in an unknown function located in the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the SpELFunction component to minimize the risk of exploitation.

Exploit

RCE

Weakness Enumeration

CWE-917

CWE-20

Related Identifiers

CVE-2026-8759

GHSA-FMMW-44RP-JCFP

Affected Products

Beetl

References · 12

• 🔥 https://gitee.com/xiandafu/beetl/issues/IIYAWC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8759 · Security Note
• https://osv.dev/vulnerability/GHSA-fmmw-44rp-jcfp · Vendor Advisory
• https://gitee.com/xiandafu/beetl · Note
• https://vuldb.com/submit/811316 · Note
• https://t.me/CVEtracker/54069 · Telegram Post
• https://vuldb.com/vuln/364386/cti · Note
• https://t.me/cveNotify/163787 · Telegram Post
• https://twitter.com/DFIR_Lab/status/2060155488193446264 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2056038550324318510 · Twitter Post
• https://twitter.com/CVEnew/status/2056253267252761043 · Twitter Post
• https://vuldb.com/vuln/364386 · Note