Dromara UJCMS EUVD-2026-64664

Exploitation requires an authenticated session with high-privilege backend administrator access to the UJCMS application - this is the single most significant limiting factor. The vulnerable function is the update handler in WebFileTemplateController.java, reachable via the backend web-file-template API endpoint. The attack is network-reachable (AV:N) with no user interaction required (UI:N) and low attack complexity (AC:L) once credentials are obtained. Exploitation is entirely blocked without prior backend admin authentication; the vulnerability is also constrained to UJCMS versions 10.1.0 through 10.1.3. There is no evidence the endpoint is exploitable anonymously or by low-privilege users. Deployments that restrict backend admin panel access to internal networks or VPNs face substantially reduced exposure compared to internet-exposed admin interfaces.

The CVSS 4.0 base score of 5.1 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) positions this as a moderate-severity finding, with the high privilege requirement (PR:H) being the dominant risk-reducing factor. The E:P modifier - proof-of-concept exploit publicly available - elevates practical exploitability above the base score alone. No CISA KEV listing exists, meaning no confirmed active exploitation at time of analysis. EPSS data was not provided. The critical tension in this assessment is between the vendor-assigned low impact scores and the well-established capability of unsandboxed FreeMarker SSTI to achieve full remote code execution via JVM reflection - the 'Information Disclosure' tag and low impact metrics suggest the published PoC may demonstrate only partial exploitation, but the actual ceiling depends on how aggressively UJCMS restricts FreeMarker directive access. Organizations with broadly distributed backend admin credentials or internet-exposed CMS admin panels should treat this as higher priority than the raw score implies, while those with tightly controlled admin access and internal-only backend exposure face materially lower risk.

An attacker who has obtained backend administrator credentials - through phishing, credential stuffing, or insider access - authenticates to the UJCMS backend interface and submits a crafted FreeMarker template payload via the web-file-template update API endpoint. The CMS passes the attacker-controlled content to the FreeMarker engine without sanitizing dangerous directives, enabling the attacker to enumerate server-side environment variables, read sensitive configuration files, or invoke Java runtime methods to execute operating system commands. A published proof-of-concept on GitHub demonstrates this injection path and has lowered the technical barrier for exploitation.