Description

A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-23T20:16:50.380Z",
  "pubdate": "2026-08-23T20:16:50.380Z",
  "executiveSummary": "A security vulnerability has been identified in Dromara UJCMS up to version 10.1.3, specifically within the update function of the src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java file inside the web-file-template endpoint. This flaw involves the improper neutralization of special elements utilized by a template engine, presenting significant security risks to deployments.\nThe vulnerability allows remote attackers to execute arbitrary manipulation of template inputs. If successfully exploited, this weakness can lead to severe security consequences, including remote code execution or unauthorized server-side template evaluation, compromising the integrity, confidentiality, and availability of the underlying host system.\nThe affected product is Dromara UJCMS across versions up to 10.1.3. Given that a public exploit has already been published and is accessible to threat actors, the risk level is elevated, necessitating immediate attention from system administrators and security personnel.\nAttack capabilities include remote execution without requiring advanced physical access. Exploitation requirements involve interacting with the vulnerable backend API endpoint where file and template modifications are handled, allowing malicious payloads to be injected directly into the template processing pipeline.",
  "technicalDetails": "The vulnerability resides in the web-file-template component of Dromara UJCMS up to version 10.1.3, specifically encapsulated within the update method implemented in src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java.\nThe root cause of the flaw is the improper neutralization of special elements used within the underlying template engine. When user-supplied input or file content modification requests are processed by the update function, the application fails to adequately sanitize, escape, or validate characters and syntax sequences that hold special meaning to the template parser.\nBecause the vulnerable endpoint is exposed to remote access, an unauthenticated or authenticated remote attacker—depending on the exact access control implementation of the endpoint—can transmit a crafted HTTP request containing malicious template directives or syntax constructs.\nThe attack flow proceeds as follows: First, the attacker identifies the web-file-template endpoint handling the update functionality. Second, the attacker crafts an exploit payload containing specialized template engine syntax designed to break out of standard text contexts and execute arbitrary expressions. Third, the attacker submits this payload via the network to the update function in WebFileTemplateController.java. Fourth, the application processes and passes the unsanitized input to the template engine for evaluation or file writing. Finally, the template engine interprets the malicious syntax, resulting in the execution of unauthorized logic or code within the server environment.\nThe post-exploitation impact includes full system compromise, potential lateral movement within the network, unauthorized data access, and persistent control over the affected application instance due to the capability to manipulate server-side templates and files."
}