CVE-2026-78140

Executive Summary

CVE-2026-78140 is a server-side template injection (SSTI) vulnerability affecting Dromara UJCMS up to version 10.1.3, specifically in the web-file-template endpoint. The flaw exists in the update function of WebFileTemplateController.java, where improper neutralization of special elements allows an authenticated attacker with high privileges to execute arbitrary template-engine directives remotely. The vulnerability carries a CVSS score of 4.7 (medium severity), requires high privileges, and no patch is currently available, making affected systems exposed to template-based code execution and data exfiltration.

Technical Analysis

The vulnerability resides in the Dromara UJCMS content management system, a Java-based platform. The impacted component is the web-file-template endpoint, located in the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java. Specifically, the update function within this controller fails to properly sanitize user-controlled input before passing it to the underlying template engine.

The weakness is classified under CWE-791 — Improper Neutralization of Special Elements Used in a Template Engine. This vulnerability class arises when application data is concatenated into template strings without proper escaping or validation. In an SSTI scenario, the template engine interprets attacker-injected syntax (such as ${...}, #{...}, or engine-specific expression delimiters) as executable template code rather than literal data.

Attack surface details: The endpoint is exposed through the backend API layer of UJCMS, meaning it is reachable over the network (AV:N). Exploitation requires high privileges (PR:H) — likely an authenticated administrator or operator account that has permission to manage web file templates. The attack requires no user interaction (UI:N) and does not affect systems outside the target's security scope (S:C unchanged per the CVSS vector).

The underlying mechanism: The update function likely receives a template name/path and content as parameters. When updating a template file, the content is passed to the template engine for rendering or storage. If the engine evaluates expressions at render time — common with engines like FreeMarker, Velocity, or Thymeleaf — injected expressions are executed with the application's context, potentially allowing the attacker to read environment variables, access files, or invoke Java objects and methods.

No additional implementation details are disclosed in the NVD description. The exploit has been published but no PoC code, Nuclei template, or exploit code is available in tracked sources. The lack of patch information (confidence 0/4) confirms that no upstream fix exists.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The scenario is as follows:

Step 1 — Reconnaissance/Target Identification: An attacker with valid high-privileged credentials (or who has compromised an administrator account) maps the UJCMS backend API endpoints. The web-file-template endpoint is discoverable through API documentation, source code analysis, or by fingerprinting the application. The target is identified by the presence of /web/backendapi/ or similar API routes associated with UJCMS.

Step 2 — Flaw Trigger: The attacker authenticates to the backend API and sends a request to the update function of the web-file-template controller. The request typically includes parameters identifying the template to update and the new template content. The server-side flaw is that the content is not sanitized before assignment to the template engine.

Step 3 — Payload Execution: The attacker injects template-engine expression syntax into the template content field. For example, with FreeMarker (<#assign x = "freemarker.template.utility.Execute"?new()>${x("cat /etc/passwd")}) or Velocity (#set($x='')#set($rt=$x.class.forName('java.lang.Runtime'))#set($chr=$x.class.forName('java.lang.Character'))). The exact syntax depends on the engine embedded in UJCMS; the class name and file paths are not specified in the advisory, so specific payloads remain engine-dependent. The malicious expression is embedded in the template, and when the template is subsequently rendered (either by the update process itself or at a later page-request time), the expression executes with the application's runtime privileges.

Step 4 — Post-Exploitation Impact: Depending on the template engine's capabilities and Java security manager configuration, the attacker can: (a) read sensitive files on the server (/etc/passwd, application configuration files with database credentials); (b) execute arbitrary system commands (when the engine exposes command-execution utilities); (c) exfiltrate data via outbound HTTP requests; (d) potentially achieve remote code execution (RCE) and establish persistence if the engine permits full Java reflection access. The CVSS subscores (Confidentiality: L, Integrity: L, Availability: L) suggest partial compromise of each aspect, not complete system takeover.

Impact Assessment

• Business Impact: UJCMS is a content management system; a compromised instance can lead to website defacement, data theft (user databases, CMS configuration), and lateral movement into adjacent infrastructure if the CMS host connects to other internal services.
• Affected Systems: All UJCMS deployments ≤ 10.1.3 that expose the backend API. Only tenants that restrict backend network access may be partially protected.
• Blast Radius: The attack requires network access and high privileges, limiting the blast radius to authenticated attackers. However, the "Published exploit" finding increases the probability that attackers will weaponize the flaw once patching guidance confirms the vulnerable endpoint, or that current attackers are already probing for it.
• CVSS Subscores: AV:N/AC:L (easy network exploitation), PR:H (high privileges required), UI:N (no user interaction), S:U (scope unchanged — only the vulnerable component impacted), C:L/I:L/A:L (low impact on each of the three pillars).
• CISA KEV Status: Not listed on the Known Exploited Vulnerabilities catalog as of the reporting date, meaning there is no federal mandate for immediate remediation, but the published-exploit signal warrants proactive attention.

Detection Guidance

Sigma Rule

title: UJCMS Web-File-Template SSTI Attempt
id: 5f2b8e4a-9c3d-4f7e-b2a1-7d6c9e1f8a2b
status: experimental
description: Detects attempts to exploit CVE-2026-78140, SSTI in UJCMS WebFileTemplateController update function.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78140
author: vartersit Threat Intel
logsource:
    category: webserver
    product: apache
    definition: Web server logs for UJCMS backend API requests.
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'web-file-template'
            - 'WebFileTemplate'
    selection_payload:
        cs-uri-query|contains:
            - '${'
            - '#{'
            - '<#assign'
            - '#set('
            - '${T('
            - '${''.getClass()'
    condition: selection and selection_payload
    timeframe: 30s
level: medium

Note: This is a generic detection for SSTI indicators in the URI; adjust URI patterns if the template update is performed via POST body. The name of the endpoint is derived from the NVD description's component name — API paths may vary by deployment.

YARA Rule

rule CVE_2026_78140_UJCMS_SSTI:
    meta:
        author = "valtersit Threat Intel"
        description = "YARA rule to identify SSTI payloads targeting UJCMS WebFileTemplate endpoint."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78140"
        date = "2026-06-01"
    strings:
        $s1 = "WebFileTemplateController" nocase
        $s2 = "web-file-template" nocase
        $s3 = "freemarker.template.utility.Execute" nocase
        $s4 = "java.lang.Runtime" nocase
        $s5 = "<#assign" nocase
        $s6 = "#set($" nocase
        $s7 = "${T(" nocase
        $s8 = "${''.getClass()" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7, $s8)

Note: The YARA rule scans for template-injection payload markers and endpoint identifiers. It is not exhaustive — engine-specific syntax may vary.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-78140 UJCMS SSTI Attempt"; flow:to_server,established; content:"POST"; http_method; content:"web-file-template"; http_uri; nocase; content:"${"; http_uri; nocase; or content:"<#assign"; http_uri; nocase; or content:"#set("; http_uri; nocase; sid:202678140; rev:1; classtype:attempted-admin; reference:cve,2026-78140;)

Note: Rule triggers on URI-based indicators. Deployment may require body inspection (http_client_body) if payloads ship in POST data; adjust signature accordingly.

Elastic Detection

sequence by source.ip, process.entity_id with maxspan=1m
  [network where event.action == "http_request" and destination.port in (80, 443) and
     http.request.method == "POST" and
     url.full : "*web-file-template*" and
     (url.full : "*\u0024\u007b*" or url.full : "*#set(*" or url.full : "*\u003c#assign*")]

Note: Unicode escapes (\u0024\u007b = ${) are used to avoid literal string interpretation issues.

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache
| where like(uri, "%web-file-template%")
  AND (like(uri, "%${%") OR like(uri, "%#set(%") OR like(uri, "%<#assign%") OR like(uri, "%#{%"))
| stats count by src_ip, uri, status
| `cti_reputations(src_ip)`

Note: Adjust sourcetype based on web server. For POST-body detection, parse _raw with regex for SSTI patterns instead of URI fields.

Wazuh OSSEC Rule

<group name="ujcms,ssti,">
  <rule id="100213" level="8">
    <if_sid>31100</if_sid>
    <match>web-file-template</match>
    <regex>\$\{|#set\(|&lt;#assign|#\{</regex>
    <description>UJCMS WebFileTemplate SSTI exploit attempt (CVE-2026-78140)</description>
    <group>ujcms_cve_2026_78140,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: The rule relies on Apache/IIS log formats already monitored by Wazuh (parent rule 31100 for web logs). Adjust if_sid as needed.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix is available from any tracked source. The following steps are immediate containment measures, not permanent fixes:

1. Immediate Mitigations:

   • Restrict network access to the UJCMS backend API endpoints (especially /web/backendapi/) to trusted administrative networks only — implement IP allowlisting.
   • Enforce strong multi-factor authentication (MFA) for all accounts with privileges to access the web-file-template management functions.
   • Disable the web-file-template endpoint if not actively used; if possible, remove the affected component entirely from the deployment and rebuild without it.
   • Place a Web Application Firewall (WAF) in front of the application with rules blocking template-expression patterns (${, #{, <#assign, #set() in POST bodies and URIs.
   • Monitor all template-update activity for abnormal content; alert on any administrator action that includes expression syntax.

2. Patch/Upgrade Steps:

   • Monitor the Dromara UJCMS official repository and security advisories for the patch that addresses this flaw in versions > 10.1.3.
   • Validate any updated version against known vulnerabilities before production rollout — a regression test suite should include template-management functions.

3. Long-Term Hardening:

   • Apply the principle of least privilege: restrict which roles can access the backend template-management API; consider a separate, air-gapped template-deployment pipeline.
   • Implement server-side input validation and output encoding for all template content; require allowlisted template syntax only.
   • Keep all Java runtime and template-engine libraries updated to mitigate auxiliary engine-specific SSTI protections.
   • Establish a supply-chain monitoring process for UJCMS dependencies (OSV packages) if the application is installed via package managers.
   • Run the CMS under a restricted OS user and Java Security Manager (if compatible) to limit the blast radius of any template-engine code execution. Enable container isolation and network segmentation for the CMS host to prevent lateral movement in case of exploitation.

References

1. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-78140
2. Dromara UJCMS Official Repository (for monitoring future patches): https://gitee.com/ujcms/ujcms
3. MITRE CWE-791 Description: https://cwe.mitre.org/data/definitions/791.html
4. CISA Known Exploited Vulnerabilities Catalog (negative result as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: The NVD description states "The exploit has been published and may be used." However, no specific campaign attribution, C2 infrastructure, or exploit code is available in tracked sources. As of the report date, CISA KEV does not list this CVE, and no Nuclei template or exploit code is publicly indexed. Organizations should assume potential active exploitation given the published-exploit status and the medium CVSS score that may still attract opportunistic attackers.

Report generated by valtersit.com Threat Intelligence. All technical claims derived from NVD/CVE metadata provided; no supplementary information fabricated where the description was sparse.