2491319 – (CVE-2026-12894) CVE-2026-12894 quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine

This bug is in the 'Embargoed' Data Category and access to this data must be restricted as per the Data Reuse Policy.

Bug 2491319 (CVE-2026-12894) - CVE-2026-12894 quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine

Summary: CVE-2026-12894 quarkus-qute: io.quarkus.qute.ReflectionValueResolver: Quarkus...

Keywords:
Status:	NEW
Alias:	CVE-2026-12894
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-06-22 11:22 UTC by Abhishek Raj
Modified:	2026-08-31 11:39 UTC (History)
CC List:	44 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:	Yes

Attachments	(Terms of Use)

Description Abhishek Raj 2026-06-22 11:22:32 UTC

HASH(0x5630156b9b10)

Note You need to log in before you can comment on or make changes to this bug.

adamevin
ant
anujha
asoldano
avibelli
bbaranow
bgeorges
bmaxwell
bstansbe
cescoffi
cmah
dandread
dkreling
dlofthou
fmongiar
gsmet
istudens
ivassile
iweiss
janstey
jmartisk
jnethert
kaycoth
lthon
manderse
mosmerov
msvehla
nwallace
olubyans
pberan
pesilva
pgallagh
pjindal
pmackay
probinso
rguimara
rruss
rstancel
rsvoboda
sbiarozk
security-response-team
thjenkin
tqvarnst
vdosoudi