CVE-2026-12894

Name of the Vulnerable Software and Affected Versions Quarkus (affected versions not specified)

Description A flaw in the Qute template engine, used for generating dynamic content such as HTML pages or emails, allows for a security bypass. The issue resides in the ReflectionValueResolver component, which does not properly restrict access to sensitive Java internal functions when processing specific data types, such as Enums. An attacker capable of influencing the template text can exploit this to execute unauthorized commands and gain control of the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.