CVE-2026-108264: Wizarr Media Server Manager RCE Vulnerability

CVE-2026-108264 Overview

Wizarr is an invitation and user management system for Jellyfin, Plex, Emby, and other media servers. Versions prior to 2026.9.1 evaluate wizard step Markdown through a non-sandboxed Jinja2 environment in app/blueprints/wizard/routes.py. The environment exposes application globals, which allows arbitrary Python execution when a stored step renders at GET /wizard/{server}/{idx}. Authenticated users who can create steps, or administrators importing untrusted bundles through POST /settings/wizard/import, can trigger the sink. The flaw is tracked as [CWE-1336] Improper Neutralization of Special Elements Used in a Template Engine.

Critical Impact
Server-side template injection permits operating-system command execution as the Wizarr process user, disclosure of the Flask SECRET_KEY, access to connected service credentials and the database, and stored cross-site scripting.

Affected Products

Wizarr versions prior to 2026.9.1
app/blueprints/wizard/routes.py wizard rendering path
app/jinja_filters.py and app/services/wizard_widgets.py evaluation sinks

Discovery Timeline

2026-10-09 - CVE-2026-108264 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108264

Vulnerability Analysis

Wizarr renders wizard step content supplied by editors or imported bundles through a Jinja2 environment that is neither sandboxed nor stripped of application globals. When a user visits GET /wizard/{server}/{idx}, the stored Markdown is passed through markdown and then evaluated as a template. Because Flask globals and Python built-ins are reachable from the template context, attacker-controlled expressions resolve to live Python objects. An authenticated step creator can embed Jinja2 directives that reach __class__, __mro__, or os-equivalent callables, executing arbitrary commands as the Wizarr process user. Additional sinks in app/jinja_filters.py and app/services/wizard_widgets.py expand the attack surface to widget rendering and filter evaluation.

Root Cause

The wizard route invokes Jinja2 rendering on persisted Markdown content without using SandboxedEnvironment, without autoescaping template expressions, and without sanitizing the resulting HTML. Application globals, including the Flask application and its configuration, are exposed to the template scope.

Attack Vector

An authenticated user with step-creation privileges stores malicious Jinja2 syntax inside a wizard step. Any subsequent request to the step's render endpoint executes the payload server-side. Alternatively, an administrator who imports an untrusted bundle through POST /settings/wizard/import triggers the same sink. Successful exploitation yields command execution, Flask SECRET_KEY disclosure, retrieval of connected media-server credentials, database access, and stored XSS against other wizard viewers.

python

# Patch excerpt - app/blueprints/wizard/routes.py
from pathlib import Path
from uuid import uuid4

import frontmatter
import markdown
# Source: https://github.com/wizarrrr/wizarr/commit/6aa3c33c1b3d945e055ef116cc531028b3735bb7

python

# Patch excerpt - app/blueprints/wizard_admin/routes.py
def preview_markdown():
    from markdown import markdown as md_to_html

    from app.services.wizard_html import sanitize_wizard_html

    raw = request.form.get("markdown", "")
    return sanitize_wizard_html(
        md_to_html(raw, extensions=["fenced_code", "tables", "attr_list"])
    )
# Source: https://github.com/wizarrrr/wizarr/commit/6aa3c33c1b3d945e055ef116cc531028b3735bb7

The fix routes rendered Markdown through sanitize_wizard_html and restricts wizard template rendering so attacker-controlled Jinja2 directives no longer reach the application context.

Detection Methods for CVE-2026-108264

Indicators of Compromise

Wizard step Markdown containing Jinja2 control characters such as {{, {%, or references to __class__, __mro__, __subclasses__, or config.
Unexpected child processes of the Wizarr Python interpreter, especially shells like /bin/sh, bash, or python -c.
Outbound network connections from the Wizarr host to attacker-controlled endpoints following a wizard page render.
Bundle imports via POST /settings/wizard/import from unverified sources recorded in application or reverse-proxy logs.

Detection Strategies

Inspect the Wizarr database for stored wizard steps whose Markdown bodies contain Jinja2 expression delimiters or Python dunder attribute references.
Correlate HTTP access logs for GET /wizard/{server}/{idx} with process-execution telemetry from the host.
Alert on administrative requests to POST /settings/wizard/import that originate from non-administrator sessions or unusual source IPs.

Monitoring Recommendations

Enable verbose request logging on the Wizarr Flask application and forward it to a centralized log platform for retention.
Baseline process trees for the Wizarr container or service and alert on any spawning of interactive shells or network utilities.
Monitor file integrity for app/blueprints/wizard/routes.py, app/jinja_filters.py, and app/services/wizard_widgets.py.

How to Mitigate CVE-2026-108264

Immediate Actions Required

Upgrade Wizarr to version 2026.9.1 or later as published in the GitHub Release v2026.9.1.
Audit existing wizard steps and remove any Markdown containing Jinja2 syntax or references to Python internals.
Rotate the Flask SECRET_KEY and any media-server credentials stored by Wizarr if pre-patch step creation was broadly accessible.
Review administrative audit trails for prior use of POST /settings/wizard/import with untrusted bundles.

Patch Information

The maintainers released the fix in Wizarr 2026.9.1. The patch restricts wizard template rendering and introduces sanitize_wizard_html for Markdown preview output. See the GitHub Security Advisory GHSA-h9rv-mxh2-35f3 and the GitHub Commit Overview for implementation detail.

Workarounds

Restrict wizard step creation privileges to a minimal set of fully trusted administrators until the upgrade is applied.
Disable the bundle import endpoint or place the Wizarr admin interface behind an authenticated reverse proxy with IP allow-listing.
Run the Wizarr process under a dedicated unprivileged user with no outbound internet egress beyond required media-server endpoints.

bash

# Upgrade example for Docker-based deployments
docker pull ghcr.io/wizarrrr/wizarr:2026.9.1
docker stop wizarr && docker rm wizarr
docker run -d --name wizarr \
  -p 5690:5690 \
  -v /opt/wizarr/data:/data \
  ghcr.io/wizarrrr/wizarr:2026.9.1