{"id":"CVE-2026-12894","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-12894","generatedAt":"2026-10-28T00:14:50.080Z","title":"An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.","description":"A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.","published":"2026-08-31T13:17:21.000Z","lastModified":"2026-10-20T05:16:54.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-1336"],"affected":[],"epss":{"score":0.00968,"percentile":0.61573,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.97%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:62515","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:62555","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63302","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-12894","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491319","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12894","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}