Server-Side Template Injection in Tugtainer notification templates (CVE-2026-47752)

Tugtainer versions through 1.28.3 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Affected versions: - <= 1.28.3 We recommend updating to: v1.30.2. CVSS 9.9 · our assessment: act_now Reference: https://github.com/Quenary/tugtainer/security/advisories/GHSA-g2cj-2x47-78vq Details: https://vuln.today/cve/CVE-2026-47752