EUVD-2026-96876
GHSA-gr76-wjxc-qwm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitInject template expression into content argument
-
ExecutionRunCompile evaluates malicious template (SSTI)
-
ImpactDisclose data or alter rendered output
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Template injection prevention
|
| Exploitation Conditions | Exploitation requires (1) a low-privilege authenticated account on the target application (CVSS PR:L), and (2) the application must pass attacker-controllable input into the Furion ViewEngine's RunCompile template-compilation routine so that unsanitized special template elements are evaluated. The affected product is Furion .NET Framework versions up to and including 4.9.9.95. Limiting factors that reduce realistic risk below the raw CVSS: authentication is mandatory (not remote-unauthenticated), and the flaw is only reachable where the deployed application exposes user-influenced content to the view engine - applications that never route untrusted input into RunCompile are not exploitable. |
| Impact | This is a server-side template injection (CWE-1336) in Furion .NET Framework's ViewEngine.RunCompile function, rated moderate (CVSS 4.0 base 5.3). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a low-complexity, network-reachable flaw requiring low-privilege authentication, with only Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L, no scope change). The E:P exploit-maturity flag and the description's statement that 'the exploit has been released to the public' confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided in the input, so real-world exploitation volume cannot be quantified from available data. Notably, the vendor-assigned impacts are all Low and the tags emphasize Information Disclosure, which is conservative for SSTI - classic template injection frequently escalates to remote code execution, so the Low integrity/availability ratings may understate worst-case impact and should be verified against the actual RunCompile implementation. The combination of only-moderate CVSS, required privileges, a niche (non-Microsoft) framework, and no KEV/EPSS signal places this below the priority of a network-unauthenticated critical flaw; it warrants patching for Furion users but is not an emergency for the broader population. The source is a single reporter (VulDB) with no corroborating vendor advisory, as the vendor did not respond. |
| Exploit ScenarioDerived | A low-privileged authenticated user of an application built on Furion submits input that is passed as the 'content' argument into the ViewEngine RunCompile template-compilation path; because special template elements are not neutralized, the attacker's payload is evaluated server-side, disclosing data or tampering with rendered output. Public exploit code has been released, lowering the barrier to attempts. Exploitation is remote and low-complexity but gated by the need for an authenticated account and an application that routes user-controlled input into the view engine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Server-side template injection in Furion .NET Framework up to and including 4.9.9.95 allows an authenticated, low-privileged user to have attacker-supplied template expressions evaluated by the ViewEngine.RunCompile routine, potentially disclosing or tampering with data rendered through the view engine. The flaw is rated moderate (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and is only reachable where a deployed application routes user-influenced content into RunCompile. Publicly available exploit code exists, and no CISA KEV entry confirms active exploitation.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the vendor did not respond to the disclosure, so remediation must focus on compensating controls. The most effective control is to stop routing attacker-influenced content into the View Engine: audit every call to ViewEngine.RunCompile and ensure the content argument is derived only from trusted, developer-authored templates, passing user data through the view model instead of concatenating or interpolating it into template source; this eliminates the injection primitive entirely, at the cost of losing legitimate runtime/dynamic template editing features. Where dynamic templates are a business requirement, constrain who can supply template content to privileged, trusted administrators (the flaw requires only a low-privileged authenticated account, so tightening that authorization gate removes most realistic risk) and/or validate templates against a strict allowlist of permitted directives before compilation, accepting that overly rigid allowlists may break valid templates. Additional hardening includes running the rendering process with least privilege and restricted filesystem and network access so that any successful template evaluation has limited reach, and deploying a WAF or request-inspection rule that blocks template-delimiter payloads in user-supplied fields, recognizing that WAF bypasses via encoding are common. Monitor application logs for anomalous template compilation or rendering errors, and track the VulDB references (https://vuldb.com/vuln/416227 and https://vuldb.com/vuln/416227/cti) plus the Furion project for an upstream fix; upgrade as soon as a patched release beyond 4.9.9.95 is published and independently confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an instance of CWE-1336, improper neutralization of special elements used in a template engine, more commonly known as server-side template injection (SSTI). Furion is a .NET application framework whose View Engine component compiles view templates at runtime; the affected code path is the RunCompile function in framework/Furion/ViewEngine/Engines/ViewEngine.cs, which takes a template content argument and compiles/evaluates it. Because special template elements in that content are not neutralized, content that reaches RunCompile can be interpreted as template code and executed within the server-side rendering context rather than being treated as inert text. Per the supplied CPE (cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:*) all .NET Framework releases of Furion up to and including 4.9.9.95 are in scope. The attack is remotely reachable (AV:N) but requires a low-privileged authenticated account (PR:L) and, critically, an application that passes attacker-influenced input into the RunCompile routine; the assessed impact is limited to low confidentiality, integrity, and availability effects (C:L/I:L/A:L, scope unchanged), matching the community tags of SSTI, information disclosure, and .NET Framework rather than full remote code execution.
Know when Net Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity SSTI reachable only by an authenticated low-privilege user (PR:L); impacts kept Low per vendor data, though SSTI could plausibly justify higher if RCE is confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Net Framework
View allMicrosoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameter
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
ASP.NET Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3
Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0
Exploit-DB