Executive brief
Dromara UJCMS is a content management system used for building and managing website content. A flaw in the web-file-template endpoint allows attackers to inject malicious code into template files, which could enable remote execution of arbitrary commands or access to sensitive data.
Technical details
The vulnerability is a Server-Side Template Injection (SSTI) in the WebFileTemplateController component's update function, specifically affecting FreeMarker template processing in the web-file-template endpoint. The vulnerable code in src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java fails to properly neutralize special template elements before processing user-supplied input. An attacker can send a malicious request to the update endpoint with specially crafted template syntax (leveraging FreeMarker's expression language) to execute arbitrary code on the server. No authentication is required as the endpoint is remotely accessible. Patches are likely available in versions after 10.1.3.
Affected products
- Dromara UJCMS up to 10.1.3
Timeline
- 2026-08-23: disclosed: Vulnerability published
- 2026-08-23: other: Exploit proof-of-concept published