document-merge-service CVE-2026-53964

Exploitation requires the attacker to hold high-privilege access sufficient to upload XLSX templates to the document-merge-service API (CVSS PR:H). The XLSX template feature must be enabled - disabling it fully eliminates the attack surface. The vulnerable code path is specifically triggered during XLSX template processing via the xltpl library; other template formats are not indicated as affected. Exploitation is limited by the container boundary (S:U) and runs as UID 901, not root. The limiting factors are: (1) authenticated high-privilege access required, (2) XLSX template functionality must be in use, (3) impact is scoped to the container runtime environment.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the high authentication requirement (PR:H), which is the primary risk limiter here. An attacker must hold high-privilege access - specifically the ability to upload XLSX templates - before exploitation is possible. This significantly narrows the realistic attacker population to insiders, compromised admin accounts, or users who have been granted template upload permissions. No EPSS data was provided, and KEV status is absent, meaning no confirmed active exploitation is known at time of analysis. That said, Jinja2 SSTI is a thoroughly documented and widely understood attack class, with public tooling and references (including HackTricks) cited in the advisory itself, so the technical barrier for a sufficiently privileged attacker is low. The impact within scope is severe (full container compromise, C:H/I:H/A:H), but scope change is not indicated (S:U), meaning blast radius is generally limited to the container. Even a small internal development team should treat this as urgent patching if XLSX template upload is enabled and multiple users have template-upload rights.

An authenticated user with template-upload privileges submits a crafted XLSX file containing a Jinja2 SSTI payload (for example, referencing Python builtins via the class hierarchy) to the document-merge-service API. When the service processes the template using xltpl's non-sandboxed Jinja2 environment, the injected expression is evaluated, executing an OS command as UID 901 within the container. The attacker gains shell access or can exfiltrate data from the container's filesystem and environment variables.