Skip to content
OpenAdvisories

Vendor

jumpserver

27 known vulnerabilities.

Products

jumpserver 27
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-31864 Public exploit

    JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

    JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited…

    jumpserver jumpserver
  • High 8.9
    CVE-2023-42819 Public exploit

    Path traversal in Jumpserver

    JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-4…

    jumpserver jumpserver
  • High 7.0
    CVE-2023-42820 Public exploit

    Random seed leakage in Jumpserver

    JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are…

    jumpserver jumpserver
  • High 8.2
    CVE-2023-42442 Public exploit EPSS 63%

    JumpServer session replays download without authentication

    JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, O…

    jumpserver jumpserver