Description

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-18T15:16:53.083Z",
  "pubdate": "2026-08-18T15:16:53.083Z",
  "executiveSummary": "An arbitrary file upload vulnerability exists in the Templatiq product affecting versions <= 0.2.5. This security flaw allows authenticated users with contributor-level privileges or higher to upload arbitrary files to the underlying server hosting the vulnerable application. The vulnerability poses significant risk implications, potentially leading to remote code execution, server compromise, and full system takeover depending on the server configuration and directory permissions.\nThe attack vector involves the improper validation of uploaded file types and extensions during the file processing routine within the Templatiq component. An attacker possessing contributor privileges can leverage this weakness to bypass intended restrictions and transmit malicious payloads, such as web shells or executable scripts, directly into the web-accessible directories of the target environment. Successful exploitation requires authenticated access at the contributor role tier, limiting external unauthenticated attacks but presenting a severe risk from malicious or compromised internal contributors.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and inadequate file type validation checks within the Templatiq product <= 0.2.5. Specifically, the component responsible for handling file uploads fails to restrict file extensions effectively, allowing the ingestion of dangerous file formats that can be interpreted by the underlying web server as executable code.\nThe attack flow proceeds as follows. First, an authenticated actor possessing contributor-level privileges navigates to the file upload interface provided by Templatiq. Second, the user submits a crafted multipart HTTP request containing a malicious payload disguised as or embedded within an allowed file type, or bypassing the weak extension filter altogether (e.g., uploading a PHP script or a polyglot file). Third, the vulnerable component processes the upload request without performing robust verification of the file's contents, MIME type, or structural integrity against a strict whitelist.\nConsequently, the server stores the uploaded payload within a publicly accessible directory on the filesystem. Once the file is successfully written to disk, the attacker can execute the payload by directly sending an HTTP request to the stored file path via the network. This results in arbitrary code execution under the security context of the web server process. Post-exploitation impact includes unauthorized data exfiltration, lateral movement within the network, modification of application integrity, and complete system compromise."
}