Vulnerability · Published Jul 23, 2026 · Assigned by GitHub_M

CVE-2026-47752Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

Critical 9.9

In plain English

A critical-severity security flaw in tugtainer from Quenary. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Version 1.30.2 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Quenary	tugtainer	< 1.30.2

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Quenary/tugtainer/security/advisories/GHSA-g2cj-2x47-78vq x_refsource_CONFIRM