Answer in brief
CVE-2026-57853 records a High severity (CVSS 8.7) vulnerability in DataGerry < 3.3.0 SSTI via DocAPI Template Rendering. The current sources do not mark it as known exploited. The current feed maps DataGerry/DataGerry (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps DataGerry/DataGerry (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| DataGerry/DataGerrygeneric | >=0 <3.3.0 | 3.3.0 |
Published upstream
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 4, 2026
DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.
Quoted source text, attributed separately from HOL analysis.