Wizarr CVE-2026-108264

Requires an account with privileges to create or edit wizard steps, OR administrator access to import an untrusted bundle through POST /settings/wizard/import - this is the concrete prerequisite, matching PR:H. The vulnerable sinks are the non-sandboxed Jinja2 rendering in app/blueprints/wizard/routes.py (_render), plus app/jinja_filters.py (render_jinja) and app/services/wizard_widgets.py. Execution triggers when a stored step is rendered at GET /wizard/{server}/{idx}; no victim user interaction beyond rendering is needed (UI:N). Exploitation is limited to Wizarr instances prior to 2026.9.1 and to attackers who already hold step-authoring or bundle-import privileges, which substantially narrows the realistic attacker population to trusted-but-malicious users or admins tricked into importing attacker-supplied bundles. Exploitation status: no public exploit identified at time of analysis.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CWE-1336 server-side template injection flaw lets stored Jinja2 content execute arbitrary Python in a non-sandboxed environment with application globals exposed, confirmed by the source-code diff (the fix replaces current_app.jinja_env.overlay/render_template_string with a locked-down render_wizard_template and adds nh3 HTML sanitization). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) is internally consistent: network-reachable, low complexity, scope change reflecting the jump from the web template context to OS command execution, SECRET_KEY disclosure, and database/credential access. The limiting signal is PR:H - exploitation requires privileges to create wizard steps or administrator rights to import a bundle, so this is a privileged-insider or malicious-untrusted-bundle scenario rather than anonymous internet exploitation. No EPSS score, KEV listing, or POC was provided in the input; absence of these is not evidence of safety but means there is no confirmed active exploitation or published exploit. Note a PR nuance: the description distinguishes 'an authenticated user able to create steps' (potentially lower privilege) from 'an administrator importing an untrusted bundle' - the scored vector uses PR:H, but the lower-privilege step-creation path may warrant PR:L; verify role requirements against the Wizarr RBAC model.

An authenticated Wizarr user with permission to create or edit wizard steps (or an administrator importing a malicious bundle via POST /settings/wizard/import) stores Markdown containing a Jinja2 payload. When GET /wizard/{server}/{idx} renders the step, the payload executes arbitrary Python as the application user, running OS commands, exfiltrating the Flask SECRET_KEY and connected media-server credentials, and reading the database. No public exploit code was identified in the provided data.