Server-Side Template Injection in DataGerry Affects Docker Deployment

CVE-2026-57853

What is CVE-2026-57853?

DataGerry versions prior to 3.3.0 are susceptible to a server-side template injection vulnerability. Authorized attackers with the 'base.docapi.template.add' permission can inject arbitrary Jinja2 payloads into the 'template_data' field through a POST request to /rest/docapi/template. When the template is rendered via GET /rest/docapi/template//render/<object_id>, the injected payload is executed in a non-sandboxed Jinja2 environment. This allows attackers to exploit the application using the standard 'cycler.init.globals.os' gadget chain to execute arbitrary operating system commands as the DataGerry web process user, typically root in Docker deployments, facilitating remote code execution.

References