CVE-2020-7799

HIGH 7.2CVE-2020-7799 · Published 28/01/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
fusionauth fusionauth	`< 1.11.0`	`1.11.0`

Description

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.

References

packetstormsecurity.com/files/156102/FusionAuth-1.10-Remote-Command-Execution.html · Third Party Advisory
fusionauth.io/docs/v1/tech/release-notes · Exploit
lab.mediaservice.net/advisory/2020-03-fusionauth.txt · Third Party Advisory
seclists.org/bugtraq/2020/Jan/39 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free