Which versions of Beetl are affected by CVE-2026-8759?

CVE-2026-8759 is a remote expression language injection vulnerability in Beetl template engine (versions ≤3.20.2) that allows unauthenticated attackers to execute arbitrary code on affected systems.

Is there a public PoC exploit available for CVE-2026-8759?

Yes, a public proof-of-concept exploit is available for CVE-2026-8759. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-8759?

Within 24 hours: inventory all systems running Beetl template engine and identify version numbers; isolate or restrict network access to affected instances pending remediation. Within 7 days: evaluate vendor alternatives or implement input validation/WAF rules to block SpEL function calls; contact Beetl maintainers for patch timeline. Within 30 days: migrate to patched Beetl version (≥3.20.3 if released) or replace with actively maintained template engine alternative.

Beetl CVE-2026-8759

Q: What is the CVSS score of CVE-2026-8759?

CVE-2026-8759 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30704 MEDIUM

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-05-17 VulDB

GHSA-fmmw-44rp-jcfp

Java Information Disclosure

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

May 17, 2026 - 15:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 17, 2026 - 15:00 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on com.ibeetl:beetl-spring-classic (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.20.2.RELEASE.

DescriptionCVE.org

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Expression language injection in Beetl template engine versions up to 3.20.2 enables remote attackers to execute arbitrary expressions through the SpELFunction component. The vulnerability stems from improper neutralization of special elements in Spring Expression Language (SpEL) processing, with publicly available exploit code and no vendor response despite early notification. CVSS 7.3 indicates moderate severity with confirmed remote exploitability.

Technical ContextAI

Beetl is a Java template engine that integrates with Spring Framework through the SpELFunction component located at beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java. The vulnerability is classified as CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), which occurs when user input is not properly sanitized before being evaluated as SpEL expressions. This allows injection of malicious expressions that can access Java methods and objects beyond intended scope.

RemediationAI

No vendor-released patch identified at time of analysis. The vulnerability was reported to the project maintainers via issue IIYAWC but no response has been received according to the disclosure. As immediate mitigation, disable or restrict access to SpELFunction functionality if possible, particularly any endpoints that accept user-controlled input processed through this component. Consider implementing input validation to block SpEL injection patterns before they reach the template engine. Organizations should monitor the project repository at https://gitee.com/xiandafu/beetl/ for eventual patches and consider alternative template engines if the vendor remains unresponsive.