---
id: CVE-2026-57853
title: DataGerry < 3.3.0 SSTI via DocAPI Template Rendering
summary: >-
  DataGerry before 3.3.0 contains a server-side template injection vulnerability
  that allows authenticated attackers with base.docapi.template.add permission
  to store arbitrary Jinja2 payloads in the template_data field via POST
  /rest/doca…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1336
  - CWE-79
vendor: DataGerry
product: DataGerry
affected:
  - DataGerry < 3.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T19:07:00.098515Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:07:10.757Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57853'
references:
  - url: 'https://github.com/DataGerry/DataGerry/releases/tag/3.3.0'
    label: Fixed Release Tag
  - url: 'https://docs.datagerry.com/en/latest/reference/changelog.html'
    label: Changelog
  - url: >-
      https://www.vulncheck.com/advisories/datagerry-ssti-via-docapi-template-rendering
    label: 'VulnCheck Advisory: DataGerry < 3.3.0 SSTI via DocAPI Template Rendering'
tags:
  - cve.org
epss: 0.00551
epssPercentile: 0.4633
ingestedAt: '2026-11-05T22:38:31.507Z'
---

## Overview

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.

## Affected

- `DataGerry < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.