EUVD-2026-102142
GHSA-359r-cw6w-hmm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SolusVM 2 panel
-
DeliveryInject template syntax into rendered field
-
ExploitTrigger server-side template evaluation
-
ExecutionExecute arbitrary code as root
-
ImpactFull host and hypervisor compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Template injection prevention
|
| Exploitation Conditions | Exploitation requires valid authenticated access to a SolusVM 2 management panel (CVSS PR:L), so the attacker must already hold low-privileged credentials such as a client, reseller, or sub-account on the hosting provider's instance - this is the primary limiting factor and excludes fully anonymous attackers. Given it, the flaw is a server-side template injection reachable over the network (AV:N) with low attack complexity and no user interaction (AC:L/UI:N), affecting SolusVM 2 up to and including version 2.0.0-44576; successful injection yields code execution as root. The exact panel field or feature that renders attacker input through the template engine is not specified in the available data and should be confirmed against the vendor advisory. |
| Impact | This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-level authentication, with high impact to confidentiality, integrity, and availability on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with the description's claim of arbitrary code execution as root via server-side template injection (CWE-1336). The description's 'remote authenticated users' aligns cleanly with PR:L, so there is no network-vs-local conflict here. The main mitigating signal is PR:L: an attacker needs valid panel credentials, which bounds exposure to users who can already authenticate (e.g., tenants/resellers/clients of a hosting panel) rather than fully anonymous internet attackers. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so exploitation probability cannot be quantified and there is no evidence of active exploitation - the signals are thus a vendor-confirmed severe code-execution flaw with authentication as the primary barrier, but no current indication of in-the-wild use. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to a SolusVM 2 instance (for example a reseller or client account on a hosting provider's panel) submits input into a field that is unsafely rendered by the server-side template engine, injecting template syntax that breaks out into code execution. Because the resulting code runs as root, the attacker gains full control of the host managing the virtualization environment. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Server-side template injection in SolusVM 2 up to and including build 2.0.0-44576 lets a remote authenticated user run arbitrary code as root on the management node, so a single low-privileged panel account - a client, reseller, or sub-account on the hosting provider's instance - is enough to potentially take over the underlying virtualization infrastructure. Exploitation requires valid credentials (CVSS PR:L) and no user interaction (UI:N), which is the primary limiting factor and excludes fully anonymous attackers, but because the injected template reaches a code-execution sink running with root privileges the confidentiality, integrity, and availability impact is high across both the vulnerable component and dependent systems (CVSS 9.4). No public exploit identified at time of analysis and the flaw is not reported as confirmed actively exploited.
RemediationAI
Primary action is to apply the vendor's fixed release: consult the SolusVM 2 advisory at https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2 and upgrade past the affected boundary of build 2.0.0-44576 - the affected range ends at that build, so any release the vendor publishes beyond it resolves the flaw, but the exact patched version number is not specified in the available data and must be taken from the advisory rather than assumed. Until the upgrade is applied, treat this as a patch available per vendor advisory; no public exploit code has been identified, so emergency out-of-band changes are not required, but the fix should be scheduled as high priority. Compensating controls, each with trade-offs: restrict who can hold panel credentials by reviewing and pruning reseller, client, and sub-account logins that no longer need panel access (reduces the authenticated attack surface but adds administrative overhead and may interrupt self-service provisioning); enforce multi-factor authentication and strong unique credentials on every panel account (raises the bar for credential-based access but does not stop a legitimate low-privileged user from exploiting the SSTI); front the panel with an IP allowlist or VPN-only access for administrative and reseller interfaces (side effect: blocks legitimate remote users and mobile access); and instrument the panel node for anomalous child-process creation, outbound connections, or template-rendering errors originating from web worker users, since root-level code execution would typically surface there. Running the panel backend as a non-root user, if the product supports it, would downgrade the impact from full root compromise, but it is an architectural change with a real risk of breaking provisioning operations and should be validated in a staging environment first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-1336, improper neutralization of special elements used in a template engine, which is the server-side template injection (SSTI) family: user-controlled input is passed into a server-side templating engine and the engine evaluates it instead of treating it as inert data. WebPros SolusVM 2 is a KVM-based virtual server management panel that hosting providers expose to clients and resellers for provisioning and administration; because the panel's backend processes run with elevated privileges, a template expression that reaches a code-execution sink inside the rendering context yields arbitrary command execution as root rather than a harmless rendering error. The CPE cpe:2.3:a:webpros:solusvm_2:*:*:*:*:*:*:*:* marks the WebPros SolusVM 2 product line, with the affected range bounded at build 2.0.0-44576. Unlike cross-site scripting, where payload execution happens in a victim's browser, the template is evaluated on the server, so the attacker's payload runs on the node itself - which is why the assessed scope is changed (S:C) and all three impact metrics are high. The specific panel field, endpoint, or template feature that renders attacker input has not been published in the available data and should be confirmed against the vendor advisory before building detection signatures.
Know when Solusvm 2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable SSTI needing only low-privileged panel credentials (PR:L, AC:L); code runs as root beyond the app's authorization context, so S:C with full C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Executive ViewAI
SolusVM 2 management nodes up to build 2.0.0-44576 contain a critical flaw that could allow an attacker with a low-privileged panel account to compromise the entire virtualization infrastructure. Because the issue can lead to root-level control of the management node, a single compromised client or reseller credential could expose all hosted customers and dependent services. Leadership should prioritize this as a severe operational and reputational risk, especially given the absence of a vendor patch.
No vendor-released patch identified at time of analysis. Restrict management panel and API access to trusted networks, enforce multi-factor authentication, apply least privilege to all panel accounts, disable unused reseller/client/sub-accounts, segment the management node from hosted workloads, and monitor for suspicious template rendering or unexpected root-level activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB