CVE-2026-112159

MediumCVSS 5.5/10Last modified Oct 20, 2026

Description

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-112164.3Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1121618.5MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker wi CVE-2026-112176.5Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend CVE-2026-1121777.3A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase CVE-2026-1121787.1MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or CVE-2026-1121795.3In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non CVE-2026-112186.8Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinc CVE-2026-1121805.1MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed fr CVE-2026-1121834.8MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, th CVE-2026-1121844.8MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-mo CVE-2026-1121887.1MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration CVE-2026-112194.3Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictio