CVE-2026-53964

Name of the Vulnerable Software and Affected Versions document-merge-service versions prior to 9.1.0

Description Remote code execution is possible through server-side template injection (SSTI), a flaw where an application improperly handles template inputs, allowing an attacker to inject and execute malicious code on the server. This issue specifically affects XLSX templates because the xltpl library utilizes a non-sandboxed Jinja environment for template processing. Successful exploitation allows user-supplied code to run within the server context as the document-merge-server user (UID 901), granting significant control over the container.

Recommendations Update to version 9.1.0. Disable the upload and usage of XLSX templates as a temporary mitigation measure.