Quarkus Qute
Approved changes feed: RSS · Atom
cpe:2.3:a:quarkus:quarkus-qute:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Quarkus (62206e5a-9724-5a4b-af3a-7b5eaa3d232b) |
|---|---|
| Product | Quarkus Qute (53f19660-c4c1-5002-a1ba-9afb941129f2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12894 |
vulnerable | 2026-09-16 04:32:50.826203 |
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
HIGH (8.8)
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Published: 2026-08-31T12:14:12.124Z
Updated: 2026-10-20T04:31:05.688Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.