CVE-2026-3725: SmartAdmin FreeMarker RCE Vulnerability

CVE-2026-3725 Overview

A Server-Side Template Injection (SSTI) vulnerability has been identified in 1024-lab/lab1024 SmartAdmin versions up to 3.29. This vulnerability affects the freemarkerResolverContent function within the FreeMarker Template Handler component, specifically in the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java. An attacker can exploit this flaw by manipulating the template_content argument, leading to improper neutralization of special elements used in the FreeMarker template engine.

Critical Impact

Successful exploitation allows remote attackers to inject malicious template directives, potentially leading to arbitrary code execution, sensitive data exposure, or server compromise through the email template rendering functionality.

Affected Products

• 1024-lab/lab1024 SmartAdmin versions up to 3.29
• SmartAdmin FreeMarker Template Handler component
• SmartAdmin Email Template Rendering functionality

Discovery Timeline

• 2026-03-08 - CVE CVE-2026-3725 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-3725

Vulnerability Analysis

This vulnerability is classified under CWE-791 (Incomplete Filtering of Special Elements), which occurs when the application fails to properly neutralize special elements used by the FreeMarker template engine. The freemarkerResolverContent function in the MailService.java file processes user-supplied template content without adequate sanitization, allowing attackers to inject FreeMarker template directives that execute server-side.

FreeMarker is a powerful Java-based template engine commonly used for generating dynamic content. When template content is not properly validated, attackers can inject directives that leverage FreeMarker's built-in capabilities to access Java objects, execute system commands, or read sensitive files from the server.

The vulnerability is remotely exploitable and requires low privileges to execute, making it accessible to authenticated users with access to the email template functionality. The vendor was contacted about this disclosure but did not respond, leaving users without an official patch.

Root Cause

The root cause of this vulnerability lies in the inadequate input validation and sanitization within the freemarkerResolverContent function. The function processes the template_content argument directly through the FreeMarker template engine without filtering or restricting dangerous template directives. This allows special FreeMarker elements such as built-in functions and object accessors to be injected and processed, bypassing intended security boundaries.

Attack Vector

The attack can be launched remotely over the network by an authenticated attacker with access to the email template functionality. The attacker manipulates the template_content parameter to inject malicious FreeMarker template directives. When the template is rendered by the MailService component, the injected code executes on the server with the privileges of the application. This can be leveraged to read arbitrary files, execute system commands, or access sensitive Java runtime objects.

The vulnerability mechanism involves injecting FreeMarker built-in objects and directives into the template content. Attackers typically target the FreeMarker runtime by accessing built-in objects like freemarker.template.utility.Execute or leveraging the ?new built-in to instantiate arbitrary Java classes. For detailed technical analysis and exploitation techniques, refer to the Notion SSTI Analysis documentation.

Detection Methods for CVE-2026-3725

Indicators of Compromise

• Unusual FreeMarker template syntax appearing in email template content fields, particularly directives containing ?new, ?api, or class instantiation patterns
• Log entries showing errors related to FreeMarker template processing with unexpected class instantiation attempts
• Outbound connections from the application server to unknown external hosts following email template operations
• Evidence of file read operations or command execution originating from the Java application process

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block FreeMarker SSTI payloads in HTTP request parameters
• Monitor application logs for FreeMarker template processing errors that indicate injection attempts
• Deploy runtime application self-protection (RASP) solutions to detect template injection at the execution level
• Use SentinelOne Singularity XDR to identify anomalous process behavior and command execution patterns from the Java application

Monitoring Recommendations

• Enable detailed logging for the MailService component and FreeMarker template processing operations
• Configure alerts for template processing failures or exceptions that may indicate exploitation attempts
• Monitor network traffic from the application server for unusual outbound connections
• Implement file integrity monitoring on sensitive configuration and data files that could be targeted through SSTI

How to Mitigate CVE-2026-3725

Immediate Actions Required

• Restrict access to the email template functionality to trusted administrators only
• Implement input validation to reject template content containing dangerous FreeMarker directives
• Configure FreeMarker with a restricted class resolver to prevent instantiation of dangerous classes
• Review and audit existing email templates for any signs of malicious content injection

Patch Information

No official patch has been released by the vendor. The vendor was contacted early about this disclosure but did not respond. Users should implement the workarounds listed below and consider alternative solutions if the vendor remains unresponsive. Monitor the VulDB advisory for updates on vendor response and potential patches.

Workarounds

• Configure FreeMarker with new_builtin_class_resolver set to SAFER_RESOLVER or implement a custom class resolver that blocks dangerous classes
• Disable the ?api built-in by setting api_builtin_enabled to false in FreeMarker configuration
• Implement strict input validation on the template_content parameter using an allowlist approach for permitted template constructs
• Consider sandboxing the FreeMarker template execution environment to limit potential damage from successful exploitation

# FreeMarker security configuration example (Java application.properties)
# Disable dangerous built-ins and restrict class instantiation
freemarker.settings.new_builtin_class_resolver=safer
freemarker.settings.api_builtin_enabled=false
freemarker.settings.template_exception_handler=rethrow