Tugtainer
Monthly
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Tugtainer versions before 1.16.1 transmit authentication credentials through URL query parameters rather than request bodies, causing passwords to be exposed in server logs, browser history, and proxy logs. This exposure allows attackers with access to these logs or cached data to obtain valid credentials for the Docker container management system. Public exploit code exists for this vulnerability, and a patch is available in version 1.16.1.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Tugtainer versions before 1.16.1 transmit authentication credentials through URL query parameters rather than request bodies, causing passwords to be exposed in server logs, browser history, and proxy logs. This exposure allows attackers with access to these logs or cached data to obtain valid credentials for the Docker container management system. Public exploit code exists for this vulnerability, and a patch is available in version 1.16.1.