CVE-2026-53964: Adfinis Document Merge Service RCE via SSTI in XLSX templates

Executive brief

Document Merge Service is a document processing tool that uses template libraries to generate merged documents. An attacker with administrative privileges can upload specially crafted XLSX template files containing Jinja2 template injection payloads that execute arbitrary code on the server with the privileges of the document-merge-server process, potentially compromising the entire container and all data within it.

Technical details

The vulnerability is a server-side template injection (SSTI) flaw in the xltpl library used by Document Merge Service to process XLSX templates. The library uses an unsandboxed Jinja2 environment, allowing attackers to inject arbitrary template expressions into XLSX files. An authenticated user with upload privileges can craft a malicious XLSX template containing Jinja2 code that is executed server-side as the document-merge-server user (UID 901). This grants the attacker remote code execution within the service's container context. The CVSS v3.1 base metrics indicate the attack requires high privileges and network access, with no user interaction required, resulting in complete confidentiality, integrity, and availability impact. The vulnerability was patched in version 9.1.0.

Affected products

• Adfinis Document Merge Service < 9.1.0

Timeline

• 2026-06-11: disclosed: Initial disclosure on GitHub Advisory Database
• 2026-08-19: advisory: Published to GitHub Advisory Database as GHSA-w47q-945m-q9pc
• 2026-06-11: patched: Fixed in version 9.1.0

References

• https://api.github.com/users/sofianeelhor
• https://github.com/sofianeelhor
• https://api.github.com/users/sofianeelhor/gists%7B/gist_id%7D
• https://api.github.com/users/sofianeelhor/repos
• https://avatars.githubusercontent.com/u/43454096?v=4
• https://api.github.com/users/sofianeelhor/events%7B/privacy%7D