EUVD-2026-30941
GHSA-29wv-cv7p-xjc2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.
AnalysisAI
{7*7} which the server evaluates to 49. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
{...}); disable XML file upload functionality where operationally feasible. Within 30 days: Establish automated monitoring of Eclipse GlassFish security advisories; develop and test a migration path to patched versions when vendor releases updates.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today