Skip to content
Heist/ feed
High

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Type: advisorySource: Official CVE List1 source record

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

Announced Source revision 1
Original source ↗

CVE-2026-12894

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-12894

quarkus-qute

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Build of Apache Camel 3.33.3.SP1

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat build of Quarkus 3.27.5.SP1

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat build of Quarkus 3.33.3.SP1

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/8/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/9/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Quarkus",
    "product": "quarkus-qute",
    "versions": [
      {
        "status": "affected",
        "version": "3.27.0",
        "lessThan": "3.27.5.SP1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.33.0",
        "lessThan": "3.33.3.SP1",
        "versionType": "semver"
      }
    ],
    "packageName": "io.quarkus:quarkus-qute",
    "collectionURL": "https://repo1.maven.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apache_camel_quarkus:3.33"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Apache Camel 3.33.3.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.33.3.redhat-00005",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.27"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.27.5.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.27.5.redhat-00004",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.33"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.33.3.SP1",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.33.3.redhat-00005",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.quarkus/quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "camel-quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "camel-quarkus-qute-component",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "quarkus-qute",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "camel-quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "camel-quarkus-qute-component",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "quarkus-qute",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-12894

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#42125 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement