Skip to content
OpenAdvisories
High · 8.8 CVE-2026-12894 EUVD-2026-68505GHSA-w5gv-wrvc-9hx8

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Published Aug 31, 2026 · Updated Oct 20, 2026 · Assigned by redhat

Vendor: Quarkus Vendor: Red Hat Product: quarkus-qute Product: Red Hat Build of Apache Camel 3.33.3.SP1 Product: Red Hat build of Apache Camel 4 for Quarkus 3 Product: Red Hat build of Quarkus 3.27.5.SP1 Product: Red Hat build of Quarkus 3.33.3.SP1 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack

Description

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Affected products

VendorProductAffectedFixed
Quarkus quarkus-qute 3.27.0 – < 3.27.5.SP1, 3.33.0 – < 3.33.3.SP1 3.27.5.SP1
Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 — —
Red Hat Red Hat build of Quarkus 3.27.5.SP1 — —
Red Hat Red Hat build of Quarkus 3.33.3.SP1 — —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —

References