CVE-2026-108264

Summary

Wizarr allows authenticated users to execute arbitrary Python code through insecure Jinja2 template evaluation, potentially leading to OS command execution, credential disclosure, and XSS attacks.

Exploitability

Moderately easy to exploit with preconditions that an authenticated user can create wizard steps or an admin can import untrusted bundles, requiring no additional user interaction once the malicious step is rendered.

Blast radius

High impact across multiple systems as the vulnerability can lead to full system compromise, credential theft, and cross-site scripting affecting all users of the media server platform.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to 2026.9.1 immediately to remediate this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.