CVE-2026-112159

MediumCVSS 5.5/10Last modified Oct 20, 2026

Description

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-112164.3Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1121618.5MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker wi CVE-2026-1121646.6The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with ac CVE-2026-1121656.9The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the CVE-2026-1121686.0The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedde CVE-2026-1121696.1Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user accou CVE-2026-112176.5Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend CVE-2026-1121706.3The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.CVE-2026-1121714.4An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosu CVE-2026-1121728.1CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute CVE-2026-1121749.3Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface runnin CVE-2026-1121777.3A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase