Back securityvulnerability.io

Server-Side Template Injection in DataGerry Affects Docker Deployment High & Critical Vulnerabilities / 5h Datagerry - Datagerry - HIGH - CVE-2026-57853. DataGerry versions prior to 3.3.0 are susceptible to a server-side template injection vulnerability. Authorized attackers with the 'base.docapi.template.add' permission can inject arbitrary Jinja2 payloads into the 'template_data' field through a POST request to /rest/docapi/template. When the template is rendered via GET /rest/docapi/template/

securityvulnerability.io • November 5, 2026

DataGerry versions prior to 3.3.0 are susceptible to a server-side template injection vulnerability. Authorized attackers with the 'base.docapi.template.add' permission can inject arbitrary Jinja2 payloads into the 'template_data' field through a POST request to /rest/docapi/template. When the template is rendered via GET /rest/docapi/template/ /render/ , the injected payload is executed in a non-sandboxed Jinja2 environment. This allows attackers to exploit the application using the standard 'cycler. init . globals .os' gadget chain to execute arbitrary operating system commands as the DataGerry web process user, typically root in Docker deployments, facilitating remote code execution.

Download the Critical Vulnerability Management Cheat Sheet

Vulnerability published Nov 4, 2026

Vulnerability published

Vulnerability Reserved Jun 25, 2026

Vulnerability Reserved

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Server-Side Template Injection Vulnerability in DataGerry A severe server-side template injection vulnerability, CVE-2026-57853, has been identified in DataGerry versions prior to 3.3.0. This flaw allows authenticated attackers with 'base.docapi.template.add' permission to inject arbitrary Jinja2 payloads into the 'template_data' field via a POST request. When rendered through a GET request, the payload executes in a non-sandboxed environment, enabling attackers to run arbitrary OS commands as the DataGerry web process user, typically root in Docker deployments. The vulnerability was published on November 4, 2026, and has a CVSS score of 8.8, indicating a high severity. A patch has been released, and users are urged to upgrade to version 3.3.0 or later. There are currently no reports of public exploitation or proof-of-concept code. Security teams are advised to restrict permissions and monitor for suspicious activity. 1 sources 71

Extracted Entities

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)

Vulnerabilities (1)