CVE-2026-57853: DataGerry < 3.3.0 SSTI via DocAPI Template Rendering
DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<objectid>. Attackers can exploit the standard cycler.init.globals.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user needs the base.docapi.template.add permission to create a malicious template. Exploitation also requires a later request to render that template for an object.
Are default Docker deployments at particular risk?
Yes. The vulnerable template is rendered by the DataGerry web process, which was confirmed to run as root in default Docker deployments. Successful exploitation in that configuration can execute operating system commands as root.
What should be done if an upgrade is not immediately possible?
Restrict base.docapi.template.add to trusted administrators and prevent untrusted users from creating or modifying document API templates. Review stored template_data values for Jinja2 payloads, especially use of cycler.__init__.__globals__.os.
How can I identify possible prior exploitation or malicious templates?
Inspect templates created through POST /rest/docapi/template and review template_data for suspicious Jinja2 expressions, particularly the cycler.__init__.__globals__.os gadget chain. Review requests to GET /rest/docapi/template/<id>/render/<object_id> associated with suspicious template IDs.