Description

A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T03:16:50.300Z",
  "pubdate": "2026-08-16T03:16:50.300Z",
  "executiveSummary": "An improper neutralization of special elements used in a template engine vulnerability, commonly categorized as Server-Side Template Injection (SSTI), has been identified in OpenBoxes up to version 0.9.6.\nThe vulnerability resides within the buildZebraTemplate function located in grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy.\nAn unauthenticated or remote attacker can exploit this flaw by manipulating input processed by the template engine, potentially leading to remote code execution or unauthorized data access depending on the template engine's configuration and underlying privileges.\nPublicly available exploits increase the operational risk, making immediate remediation critical for exposed instances.\nThe risk implications include full system compromise, loss of confidentiality, integrity, and availability of the affected OpenBoxes deployment.\nMitigation requires upgrading the affected component to version 0.9.8 or 0.9.8-hotfix1, or applying the official patch referenced by identifier deeac6a4a7aba86ce99c4bda37142e41d209293e.",
  "technicalDetails": "The vulnerability stems from insufficient sanitization and improper neutralization of user-supplied data passed into the template processing engine via the buildZebraTemplate function within grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy in OpenBoxes versions up to 0.9.6.\nWhen an application dynamically evaluates strings or constructs templates using untrusted input without proper context-aware encoding or sandboxing, template engines may interpret injected control characters or expressions as executable code.\nThe attack flow initiates when a remote adversary crafts a malicious payload containing template directives or expression language syntax designed to interact with the underlying runtime environment.\nThis payload is submitted across the network to the vulnerable endpoint handling template generation.\nUpon receipt, the buildZebraTemplate function processes the input and passes it directly to the template evaluation context without adequate validation or filtering.\nAs the template engine parses the manipulated input, it executes the embedded malicious expressions within the server-side context.\nNetwork exposure is external, allowing remote attackers to initiate the attack vector without pre-existing internal network positioning.\nThe exploitation method leverages the inherent capabilities of the template engine to execute arbitrary code or access sensitive internal application objects, depending on the scope and privilege level associated with the executing Java/Grails process.\nPost-exploitation impact ranges from arbitrary command execution on the host operating system to complete compromise of the application infrastructure, data exfiltration, or deployment of persistent backdoors."
}