Server-Side Template Injection in LMFDB by LMFDB Team

CVE-2026-123198

What is CVE-2026-123198?

The LMFDB application prior to commit 01829bd is susceptible to a server-side template injection vulnerability within the render_knowl function. This flaw permits unauthenticated attackers to inject malicious Jinja expressions through carefully crafted request parameters. By exploiting this vulnerability, attackers can manipulate query-string values or 'content' data sent to /knowledge/render/, potentially executing arbitrary operating system commands under the privileges of the web application, leading to unauthorized access and control over the server.

References