Tugtainer EUVD-2026-48329

Exploitation requires an authenticated Tugtainer account (CVSS PR:L) and the ability to set the notification title_template or body_template fields, which are rendered by an unsandboxed jinja2.Environment; the payload fires when a notification is generated/rendered. No user interaction by a victim is needed (UI:N) and the vector is network-reachable (AV:N). The primary limiting factor is that the attacker must first hold valid credentials on the instance - so risk is highest for multi-user deployments or any instance with weak/default/shared logins or public exposure. Applies to all versions before 1.30.2.

The signals are largely consistent and point to a genuine high priority where an attacker already has any authenticated account. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) reflects network reachability, low complexity, no user interaction, and a scope change from the template engine to the host OS - all plausible for unsandboxed Jinja2 leading to root RCE. The principal limiter is PR:L: exploitation requires an authenticated account, so this is not an unauthenticated internet worm but a privilege-escalation-to-RCE for any logged-in user, which is severe in multi-user or exposed self-hosted deployments. No EPSS score, KEV entry, or POC was provided, so exploitation-likelihood cannot be quantified from the input; however, SSTI-to-RCE via unsandboxed jinja2.Environment is a well-understood, easily weaponized pattern, so the low observed exploit signal likely reflects the product's small footprint rather than technical difficulty. No SSVC decision data was supplied.

An attacker with any valid Tugtainer login opens the notification settings and sets the body_template (or title_template) to a Jinja2 payload such as one that walks Python's object model to reach os.popen and run a reverse-shell or arbitrary command. When a notification renders, the payload executes as root inside the container, giving the attacker command execution and, via the mounted Docker socket, potential control over other containers. No public POC was identified at time of analysis, but the technique is standard SSTI exploitation with low complexity.