CVE-2026-78140: Dromara UJCMS Template Engine RCE Vulnerability

CVE-2026-78140 Overview

CVE-2026-78140 is a server-side template injection (SSTI) vulnerability affecting Dromara UJCMS versions up to 10.1.3. The flaw resides in the update function of src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java within the web-file-template endpoint. An authenticated remote attacker can manipulate template content processed by the FreeMarker engine, resulting in improper neutralization of special elements ([CWE-791]). A public exploit has been published, increasing exposure for unpatched deployments.

Critical Impact
Authenticated attackers with high privileges can inject FreeMarker template directives through the web-file-template endpoint, leading to unauthorized read, write, and availability impact against the UJCMS backend.

Affected Products

Dromara UJCMS versions up to and including 10.1.3
Component: web-file-template backend API endpoint
Function: update in WebFileTemplateController.java

Discovery Timeline

2026-08-23 - CVE-2026-78140 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78140

Vulnerability Analysis

UJCMS is a Java-based content management system built on Spring Boot that uses Apache FreeMarker for template rendering. The vulnerability exists in the backend administration API that allows authorized users to update web file templates. The update handler in WebFileTemplateController.java accepts template content and writes it to a location subsequently processed by the FreeMarker engine without sufficient neutralization of template directives.

Because FreeMarker exposes built-in methods that can access Java objects and invoke arbitrary classes, injected directives can escape the templating sandbox. An attacker with backend access can craft payloads that traverse the object model to invoke system-level functionality. The result is compromise of confidentiality, integrity, and availability of the CMS backend, though the requirement for high-privilege authentication constrains the attack surface.

Root Cause

The root cause is improper neutralization of special elements used in a template engine ([CWE-791]). Template content supplied through the update endpoint is trusted and passed to FreeMarker without stripping or escaping directive syntax such as <#assign>, ${...}, or built-in reflective methods. FreeMarker's default configuration in UJCMS does not restrict access to sensitive object introspection features.

Attack Vector

Exploitation requires network access to the UJCMS administration interface and authenticated credentials with sufficient privileges to invoke the web-file-template update function. The attacker submits a crafted template body containing FreeMarker directives to the vulnerable endpoint. When the template is rendered, the injected directives execute inside the FreeMarker context. A published proof-of-concept is available in the GitHub CVE Report.

No verified code examples are reproduced here. Refer to the linked advisory for exploitation details.

Detection Methods for CVE-2026-78140

Indicators of Compromise

Unexpected HTTP requests to /backendapi/web-file-template update endpoints originating from administrative accounts
Template files containing FreeMarker directives such as <#assign>, ?new(), or references to freemarker.template.utility.Execute
New or modified files under the UJCMS templates directory that do not match change management records
Outbound connections from the UJCMS Java process to unexpected hosts following template updates

Detection Strategies

Inspect application logs for POST or PUT requests targeting the web-file-template controller and correlate with the authenticated user identity
Deploy file integrity monitoring on the UJCMS templates directory to alert on unauthorized modifications
Add web application firewall signatures that flag FreeMarker directive syntax within template update request bodies

Monitoring Recommendations

Enable verbose audit logging for privileged administrative actions in UJCMS, including template create and update operations
Monitor the UJCMS Java Virtual Machine process for child process spawning, which is anomalous for a CMS runtime
Alert on administrative account logins from unusual source addresses or outside business hours

How to Mitigate CVE-2026-78140

Immediate Actions Required

Restrict network access to the UJCMS backend administration interface to trusted management networks only
Enforce strong authentication and least-privilege role assignment for accounts that can modify templates
Rotate administrative credentials and review audit logs for suspicious template modifications
Track vendor communications from Dromara for a fixed release beyond version 10.1.3

Patch Information

At the time of publication no vendor patch reference is listed in the NVD entry. Consult the VulDB advisory and the Dromara UJCMS project repository for the latest release information and apply a fixed version once available.

Workarounds

Disable or remove the web-file-template administrative endpoint if template editing is not required in production
Configure FreeMarker with a restricted TemplateClassResolver such as TemplateClassResolver.SAFER_RESOLVER to block reflective class loading
Place the UJCMS backend behind a reverse proxy that filters FreeMarker directive syntax in request bodies to the vulnerable endpoint
Run the UJCMS Java process under a low-privilege service account with restricted filesystem and network egress permissions

bash

# Example: restrict backend admin path at the reverse proxy (nginx)
location /backendapi/web-file-template {
    allow 10.0.0.0/24;   # management network only
    deny all;
    proxy_pass http://ujcms_backend;
}