CVE-2026-96658

Summary

The flaw allows an authenticated attacker with low-level permissions to execute arbitrary commands on the hosting server by bypassing the safemode sandbox within the templating engine.

Exploitability

Exploitation is moderately hard as it requires an attacker to have low-level permissions and knowledge of the templating engine's internal workings.

Blast radius

If exploited, the impact is high, as it could lead to complete control of the hosting server, potentially leading to data loss or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the fixed version 2.590 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.