CVE-2026-105474 in SolusVM
Summary
by MITRE • 10/15/2026
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Solus VM versions prior to 2.0.0-44576 represents a critical server-side template injection flaw within the virtualization management platform's web interface. This security defect arises from improper neutralization of special elements used in templates, allowing an attacker to inject malicious code that is subsequently processed by the backend rendering engine. Unlike cross-site scripting vulnerabilities which primarily affect client-side execution, this vulnerability operates on the server side, meaning the injected payload executes within the context of the application's runtime environment rather than the user's browser. The core technical flaw lies in the failure to properly sanitize or escape input data before it is passed to the template engine for rendering. When a remote authenticated user provides crafted input through any accessible parameter that feeds into these templates, the server interprets this input as executable code rather than static content. This lack of validation allows the attacker to break out of the intended context and execute arbitrary commands on the underlying host system.
The operational impact of this vulnerability is severe due to the privilege level associated with the Solus VM service account. In many default configurations, the web application runs with elevated privileges necessary to manage virtual machines, networks, and storage resources across physical hosts. Consequently, successful exploitation enables a remote authenticated attacker to achieve arbitrary code execution as root or an equivalent high-privilege user on the host server. This level of access grants complete control over the infrastructure managed by Solus VM. An adversary can read sensitive configuration files, exfiltrate customer data stored within virtual machines, modify system configurations, install persistent backdoors, and pivot to other systems on the internal network. The ability to execute commands as root effectively compromises the confidentiality, integrity, and availability of all services hosted on that physical node, turning a single vulnerability into a catastrophic infrastructure breach.
From a classification perspective, this issue aligns with CWE-94, commonly known as Server-Side Template Injection (SSTI), which describes flaws where user input is embedded in server-side templates without adequate sanitization. The attack vector falls under ATT&CK technique T1059, specifically Command and Scripting Interpreter, as the attacker leverages the template engine to invoke system commands. Furthermore, because exploitation requires authentication, it relates to CWE-287, Improper Authentication, although the primary flaw is in input validation rather than credential bypass. The presence of this vulnerability indicates a significant gap in secure coding practices regarding how user-supplied data interacts with dynamic content generation components within the application architecture.
Mitigation strategies must prioritize immediate patching and access control hardening. The most effective remediation is to upgrade Solus VM to version 2.0.0-44576 or later, where this specific template injection flaw has been addressed by developers through improved input validation and output encoding mechanisms. Until the patch can be applied, administrators should restrict network access to the Solus VM web interface using firewalls or VPNs, ensuring that only trusted IP addresses can reach the management console. Additionally, implementing strict role-based access control ensures that fewer users possess administrative privileges capable of interacting with vulnerable endpoints. Security monitoring solutions should also be configured to detect anomalous patterns in HTTP requests containing template syntax characters such as double curly braces or specific function calls often used in SSTI payloads like ${7*7} or {{config}}. Regular vulnerability assessments and penetration testing focused on web application security can help identify similar injection points before they are exploited by malicious actors seeking root-level access to virtualization hosts.