CVE-2026-12894: Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using the Quarkus Qute template engine are exposed if an attacker can provide or influence the text of a template processed by the application. The affected component is the ReflectionValueResolver used during data-value lookup.
What access does an attacker need to exploit the flaw?
The attacker needs the ability to provide or influence template text. No user interaction is required, and the listed vector indicates network-reachable exploitation with low attack complexity and low privileges required.
What could successful exploitation allow?
Successful exploitation can bypass restrictions on access to sensitive Java internal functions for certain data types such as Enums. An attacker could execute unauthorized commands and take control of the server.