PYSEC-2026-3830

    Dashboard / Vulnerabilities / PYSEC-2026-3830

    PYSEC-2026-3830

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

    Details: ### Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the `xltpl` library uses a npn-sandboxed Jinja environment for the processing of the template. ### Patches It has been patched in [v9.1.0](https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0) ### Workarounds Disable the upload/usage of XLSX templates. ### References Are there any links users can visit to find out more? https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti

    References: https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc, https://github.com/adfinis/document-merge-service, https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0, https://pypi.org/project/document-merge-service, https://github.com/advisories/GHSA-w47q-945m-q9pc, https://nvd.nist.gov/vuln/detail/CVE-2026-53964

    Affected packages

    Package

    Name: document-merge-service

    Purl: pkg:pypi/document-merge-service

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -9.1.0

    Affected versions

    5.2.0
    5.2.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2026-3830 | CVE-DB