CVE-2026-12894

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 31, 2026
Source updated: Oct 20, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

quarkus-qute

Vendor: Quarkus
Product: quarkus-qute
Platforms: Unknown
Default status: unaffected
Package: io.quarkus:quarkus-qute
Package collection: https://repo1.maven.org/maven2

quarkus-qute · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.27.0	`affected`	semver	3.27.5.SP1	Unavailable	None listed
3.33.0	`affected`	semver	3.33.3.SP1	Unavailable	None listed

Red Hat Build of Apache Camel 3.33.3.SP1

Vendor: Red Hat
Product: Red Hat Build of Apache Camel 3.33.3.SP1
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-qute
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Build of Apache Camel 3.33.3.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.33.3.redhat-00005	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Quarkus 3.27.5.SP1

Vendor: Red Hat
Product: Red Hat build of Quarkus 3.27.5.SP1
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-qute
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Red Hat build of Quarkus 3.27.5.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.27.5.redhat-00004	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Quarkus 3.33.3.SP1

Vendor: Red Hat
Product: Red Hat build of Quarkus 3.33.3.SP1
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-qute
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Red Hat build of Quarkus 3.33.3.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.33.3.redhat-00005	`unaffected`	rpm	*	Unavailable	None listed