Is there a public PoC exploit available for CVE-2026-8211?

Yes, a public proof-of-concept exploit is available for CVE-2026-8211. Prioritise patching immediately. EPSS: 0.0%.

codelibs Fess CVE-2026-8211

Q: What is the CVSS score of CVE-2026-8211?

CVE-2026-8211 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28947 LOW

Code Injection (CWE-94)

2026-05-09 VulDB

GHSA-cmq8-32v4-qp9h

Code Injection Java RCE

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 09, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 09, 2026 - 23:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 09, 2026 - 23:00 vuln.today

CVE Published

May 09, 2026 - 22:15 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/AdminDesignAction.java of the component JSP File Handler. The manipulation of the argument content results in code injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in codelibs Fess up to 15.5.1 allows remote attackers with high privileges to execute arbitrary code via manipulation of the content argument in the AdminDesignAction.java JSP file handler. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability exists in the JSP file handler component of Fess, specifically in the update function of org/codelibs/fess/app/web/admin/design/AdminDesignAction.java. The flaw is classified as code injection (CWE-94), where user-supplied input via the content parameter is processed without proper sanitization or encoding before being executed in a JSP context. This allows attackers to inject arbitrary code that will be evaluated server-side. The Java-based Fess application processes this malicious input during design template updates, leading to remote code execution capabilities.

RemediationAI

No vendor-released patch has been identified at the time of analysis despite early vendor notification. Immediate mitigation requires upgrading to a version newer than 15.5.1 if available from the codelibs project repository, or consulting the codelibs Fess GitHub repository (https://github.com/codelibs/fess) for security advisories. If upgrading is not immediately possible, restrict administrative access to the design template update function (AdminDesignAction) to only trusted administrators using network segmentation, reverse proxy rules, or IP whitelisting. Implement input validation and sanitization on the content parameter at the application level if custom modifications are feasible. Disable JSP dynamic compilation features if not required for your deployment. Monitor access logs for suspicious administrative activity, particularly changes to design templates.