CVE-2026-71880CWE-1336

CVE-2026-71880

published August 18, 2026

CVSS

7.6

EPSS

Percentile

40.4

In the wild

Unconfirmed

What it is

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

The record

Technical detail

CVSS: 7.6 · NONE
CVSS v4.0: 7.6 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00480 · 40.4th percentile
Weakness: CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published: 2026-08-18T22:19Z

References (3)

https://github.com/gbif/ipt/issues/3118 · [email protected]https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0016.md · [email protected]https://www.gbif.org/ipt · [email protected]

EPSS history

Timeline

18 AUG 17:56Z
Server-side template injection in Integrated Publishing Toolkit
cvelistv5