CVE-2026-12894: Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Q: Who is realistically exposed to this issue?

Applications using the Quarkus Qute template engine are exposed if an attacker can provide or influence the text of a template processed by the application. The affected component is the ReflectionValueResolver used during data-value lookup.

Q: What access does an attacker need to exploit the flaw?

The attacker needs the ability to provide or influence template text. No user interaction is required, and the listed vector indicates network-reachable exploitation with low attack complexity and low privileges required.

Q: What could successful exploitation allow?

Successful exploitation can bypass restrictions on access to sensitive Java internal functions for certain data types such as Enums. An attacker could execute unauthorized commands and take control of the server.

Published Jun 22, 2026

Updated

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Affected Software

3 affected components

Quarkus Qute template engine

IBM Enterprise Build of Quarkus<=3.27.1 - 3.27.5

IBM Enterprise Build of Quarkus<=3.33.1 - 3.33.3

Event History

Jun 22, 2026

Data Sourced

via Red Hat·11:22 AM

DescriptionSeverityAffected Software

Aug 31, 2026

CVE Published

via MITRE·12:14 PM

Data Sourced

via MITRE·12:14 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Sep 7, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7286498

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using the Quarkus Qute template engine are exposed if an attacker can provide or influence the text of a template processed by the application. The affected component is the ReflectionValueResolver used during data-value lookup.

What access does an attacker need to exploit the flaw?

The attacker needs the ability to provide or influence template text. No user interaction is required, and the listed vector indicates network-reachable exploitation with low attack complexity and low privileges required.

What could successful exploitation allow?

Successful exploitation can bypass restrictions on access to sensitive Java internal functions for certain data types such as Enums. An attacker could execute unauthorized commands and take control of the server.

CVE-2026-12894: Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Affected Software

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit the flaw?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit the flaw?

What could successful exploitation allow?