Quick answers
- Is CVE-2026-78140 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78140 being exploited in the wild.
- How severe is CVE-2026-78140?
- Medium severity, with a CVSS score of 4.7, published 23 August 2026.
- Which products and versions are affected?
- Dromara UJCMS up to 10.1.3.
- Is there a fix for CVE-2026-78140?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78140 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-78140?
- Check whether you run Dromara UJCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Server-Side Template Injection (SSTI) in the WebFileTemplateController component's update function, specifically affecting FreeMarker template processing in the web-file-template endpoint. The vulnerable code in src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java fails to properly neutralize special template elements before processing user-supplied input. An attacker can send a malicious request to the update endpoint with specially crafted template syntax (leveraging FreeMarker's expression language) to execute arbitrary code on the server. No authentication is required as the endpoint is remotely accessible. Patches are likely available in versions after 10.1.3.
Affected products
- Dromara UJCMS up to 10.1.3
Timeline
- 2026-08-23: disclosed: Vulnerability published
- 2026-08-23: other: Exploit proof-of-concept published