HIGH 7.2 NVD
CVE-2026-53964
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remot
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
References
- https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0
- https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-01 via NVD.
vulnfeed aggregates 10551 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.