← voltar
CVE-2026-22244

OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE

CVSS 8.5 HIGHEPSS 0.8%CWE-1336
OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Produtos afetados
open-metadata · OpenMetadata

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7