Remote Code Execution in document-merge-service via Jinja2 SSTI

The Adfinis document-merge-service is vulnerable to remote code execution (RCE) via server-side template injection (SSTI) affecting versions prior to 9.1.0. The vulnerability, tracked as CVE-2026-53964, exists in the way the application processes XLSX templates using the xltpl library. Because the underlying Jinja2 environment is not properly sandboxed, an attacker can supply malicious template content that, when processed, executes arbitrary code. The code runs with the privileges of the document-merge-server user (UID 901) within the container, granting the attacker significant control over the application environment. Defenders should prioritize updating to version 9.1.0 or disabling XLSX template processing to mitigate this risk.

Impact

Successful exploitation leads to full remote code execution in the context of the service container. This allows attackers to compromise the application, potentially access sensitive data within the environment, and perform lateral movement or persistence within the containerized infrastructure.

Recommendation

• Update the document-merge-service package to version 9.1.0 or later to patch CVE-2026-53964.
• As an immediate workaround, disable the upload and processing of XLSX templates within the document-merge-service configuration until the patch is applied.
• Implement strict input validation on all file uploads to ensure only expected file formats and content types are accepted.