Skip to content
OpenAdvisories
Medium · 6.8 Public exploit CVE-2026-31864 EUVD-2026-12085

JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

Published Mar 13, 2026 · Updated Mar 13, 2026 · Assigned by GitHub_M

Vendor: jumpserver Product: jumpserver

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks.

Affected products

VendorProductAffectedFixed
jumpserver jumpserver < 3.10.22, >= 4.0.0, < 4.10.16 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References