CVE-2026-78140 in UJCMS
Summary
by MITRE • 08/23/2026
A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/23/2026
The vulnerability identified in Dromara UJCMS versions up to 10.1.3 represents a critical server-side template injection flaw located within the web-file-template endpoint, specifically affecting the update functionality implemented in the WebFileTemplateController.java component. This security defect stems from an improper neutralization of special elements used by the underlying template engine, allowing attackers to inject malicious code that is subsequently executed on the target system. The root cause lies in the application's failure to adequately sanitize or escape user-supplied input before it is processed as part of a dynamic template structure. When administrators or authorized users attempt to update file templates through this endpoint, the system fails to distinguish between legitimate template syntax and malicious payloads embedded within the input data. This lack of rigorous validation creates an opening for remote code execution attacks that can compromise the integrity and confidentiality of the entire application infrastructure.
From a technical perspective, this vulnerability aligns with CWE-94, commonly known as Improper Control of Generation of Code or Script, often referred to in broader contexts as Server-Side Template Injection (SSTI). The attacker leverages the template engine's execution capabilities by crafting specific input strings that exploit parsing ambiguities or insufficient escaping mechanisms. By manipulating the update request parameters, an adversary can inject code snippets that interact directly with the server-side environment. Since Dromara UJCMS is a content management system often deployed in enterprise environments handling sensitive data, the ability to execute arbitrary commands on the backend poses a severe risk. The exploit has been publicly documented and validated, meaning that automated attack tools or manual exploitation techniques are readily available for malicious actors seeking to compromise systems running these affected versions.
The operational impact of this vulnerability is profound, as it effectively grants an attacker remote code execution capabilities without requiring prior authentication if the endpoint is accessible, or full system control if authenticated access is compromised. Successful exploitation can lead to complete server takeover, allowing the extraction of sensitive data such as user credentials, database contents, and proprietary business information. Furthermore, attackers may use this foothold to pivot into internal networks, install persistent backdoors, or deploy ransomware. The presence of a published exploit significantly lowers the barrier for entry, increasing the likelihood of widespread automated attacks targeting unpatched instances across the internet. Organizations relying on Dromara UJCMS face immediate risks to their availability and data integrity if this flaw remains unaddressed in production environments.
To mitigate this risk, it is imperative that administrators immediately upgrade Dromara UJCMS to a version later than 10.1.3 where the vulnerability has been patched by the development team. Until an official patch is applied or confirmed effective for specific deployment configurations, organizations should implement strict input validation and output encoding strategies within their web application firewalls to block known template injection patterns targeting this endpoint. Additionally, restricting access to the web-file-template API through network-level controls such as IP whitelisting can reduce the attack surface by limiting exposure to trusted administrative networks only. Regular security audits and code reviews focusing on template engine usage are recommended to prevent similar issues in future development cycles. Monitoring for anomalous HTTP requests containing suspicious characters or command execution patterns associated with CWE-94 should also be integrated into existing intrusion detection systems to provide early warning of exploitation attempts aligned with ATT&CK techniques involving server-side script injection and remote code execution.