{"id":"CVE-2023-49964","aliases":["EUVD-2023-53859","GHSA-2cw4-g2qv-f48w"],"status":"published","title":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting...","description":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.34684,"percentile":0.98437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74"],"published":"2023-12-11T00:00:00Z","modified":"2026-06-17T06:36:47Z","exploits":[{"source":"pocgithub","id":"mbadanoiu/CVE-2023-49964","title":"mbadanoiu/CVE-2023-49964","date":"2023-12-08","url":"https://github.com/mbadanoiu/CVE-2023-49964"}],"products":[{"vendor":"hyland","product":"alfresco_content_services"}],"references":[{"url":"https://www.alfresco.com/products/community/download","tags":["x_transferred","Product"]},{"url":"https://github.com/mbadanoiu/CVE-2023-49964","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49964"},{"url":"https://github.com/advisories/GHSA-2cw4-g2qv-f48w"}],"sources":{"cve":[{"id":"CVE-2023-49964","description":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.","status":"published","published":"2023-12-11T00:00:00Z","modified":"2024-08-02T22:09:49.648Z","updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53859","description":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.","status":"published","published":"2023-12-11T00:00:00Z","modified":"2024-08-02T22:09:49Z","updated_at":"2026-11-03T03:49:55.731961Z"}],"ghsa":[{"id":"GHSA-2cw4-g2qv-f48w","title":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting...","description":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.","status":"published","published":"2023-12-11T09:30:54Z","modified":"2023-12-23T05:05:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:55:16.323735Z"}],"nvd":[{"id":"CVE-2023-49964","description":"An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.","status":"published","published":"2023-12-11T08:15:06.603Z","modified":"2026-06-17T06:36:47.78Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:08:54.010507Z"}]}}