Quarkus Qute CVE-2026-12894

Exploitation requires that the attacker hold a low-privileged authenticated session (PR:L per CVSS) in a Quarkus application that exposes user-controllable Qute template text - this is the critical non-default precondition. Applications that render Qute templates entirely from static, developer-controlled template files are not exposed; the vulnerability only materializes when user input reaches the Qute rendering pipeline as template expressions (not just data values). The flaw is specifically triggered through Enum-type expression resolution in ReflectionValueResolver, meaning templates must be able to reference Enum members in a way the resolver processes. The CVSS S:U (Unchanged scope) indicates exploitation is bounded to the vulnerable application's own process context. Limiting factors: requires authenticated access; requires application functionality that accepts user-supplied template syntax; network exploitation only reaches systems where such features are accessible; no user interaction from a victim is needed once the attacker controls the template.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the risk profile: network-reachable exploitation with low attack complexity and only low-privilege authentication required, yielding full confidentiality, integrity, and availability impact. The PR:L metric is the key limiting factor - exploitation is not open to anonymous Internet users but requires an account or session capable of submitting or influencing Qute template text, which is an application-specific capability. No public exploit or CISA KEV listing has been identified, and the EPSS signal is absent from the provided data, meaning the current exploitation baseline appears low. However, SSTI vulnerabilities in templating engines are well-understood and template injection payloads targeting Java reflection are routinely weaponized; once application surface is identified, exploitation complexity is low. Even a mid-sized enterprise IT team in leszno running Quarkus-based web portals with user-editable content should treat this as urgent if any application tier accepts user-supplied template fragments. The absence of a KEV entry should not be interpreted as safety: the gap between SSTI disclosure and available exploit tooling is typically short once a proof-of-concept technique is documented. Priority is elevated for multi-tenant SaaS platforms, email automation systems, and internal portals where low-privileged users interact with templating features.

An authenticated user with access to a Quarkus application's template editor - such as a content author in a CMS, a marketing user configuring email templates, or an internal report builder - submits a crafted template expression that references an Enum type in a way that bypasses ReflectionValueResolver's access controls, exposing Java reflection internals. The attacker chains reflected method calls to invoke Runtime.exec() or equivalent, achieving arbitrary OS command execution under the application server's service account. No public POC has been identified at time of analysis, but the technique class is well-documented in SSTI research.