Loading vulnerability…
Server-side template injection in Wizarr wizard-step rendering
CVE-2026-108264 is a server-side template injection vulnerability in Wizarr versions before 2026.9.1. Wizard-step Markdown submitted through the editor or imported bundles is evaluated in a non-sandboxed Jinja2 environment with application globals exposed. An authenticated user permitted to create steps, or an administrator importing an untrusted bundle, can introduce malicious template content that executes arbitrary Python when the stored step is rendered. Additional evaluation sinks exist in Jinja filters and wizard-widget processing. Exploitation can enable operating-system command execution, disclosure of application secrets, access to credentials and the database, and stored cross-site scripting.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute arbitrary Python and operating-system commands with the privileges of the Wizarr application user. It can disclose the Flask SECRET_KEY, expose connected service credentials, provide access to the application database, and produce stored cross-site scripting.
Patch, then assume compromise.
Upgrade Wizarr to version 2026.9.1 or later; version 2026.9.1 fixes the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.