Bug 2539487 (CVE-2026-79310)

Summary: CVE-2026-79310 webpy: webpy: Arbitrary Code Execution via Server-Side Template Injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in webpy. This vulnerability, known as Server-Side Template Injection (SSTI), allows a remote attacker to execute malicious code on the server. By exploiting how the application precompiles and renders templates, an attacker can bypass security measures and run arbitrary Python code or operating system commands. This could lead to complete compromise of the affected server.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2540990    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-23 15:52:22 UTC 
webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server.