Vulnerability · Published Jun 11, 2024 · Assigned by GitHub_M
CVE-2024-37301document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
High 7.2
In plain English
A high-severity security flaw in document-merge-service from adfinis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | document-merge-service | 6.5.2 | GHSA-v5gf-r78h-55q6 |
| PyPI | document-merge-service | 6.5.2 | PYSEC-2026-1314 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| adfinis | document-merge-service | < 6.5.2 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H