EUVD-2026-50331
GHSA-gqhf-wf6p-pjv9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin console (AV:N) with low complexity, but requires administrator privileges (PR:H); code execution escapes the app to compromise the host (S:C) with full C/I/A impact.
Primary rating from Vendor (Toreon).
CVSS VectorVendor: Toreon
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise.
This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.
Articles & Coverage 1
AnalysisAI
Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with administrator privileges on Axway SecureTransport (CVSS PR:H) and access to the mail/notification template editing functionality - the injected Java expression only executes when a template is rendered during email sending, so the attacker must be able to save a template and trigger (or wait for) an email event that renders it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine but privilege-gated risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised SecureTransport administrator edits a mail notification template and embeds a crafted Java expression payload; when the server renders that template to send a notification email, the JVM evaluates the expression and executes attacker-chosen code. This yields command execution on the underlying host and full compromise of the MFT gateway, enabling theft of transferred files, credentials, and lateral movement. … |
| Remediation | Vendor-released patch: upgrade Axway SecureTransport to the 5.5-20260528 update or later, per the vendor advisory at https://support.axway.com/news/4882/lang/en, which is the definitive fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate actions (24 hours): Identify all Axway SecureTransport instances and document their current versions, audit and document all users with administrative access, enable enhanced logging for mail template modifications and administrative actions, and restrict admin access to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. Rate
Share
External POC / Exploit Code
Leaving vuln.today