CVE-2023-49964

8.8 highEPSS 35%

High (8.8) in hyland alfresco content services. EPSS 35% chance of exploitation in the next 30 days.

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 35% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2023-12-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hyland:alfresco_content_services

References

https://github.com/mbadanoiu/CVE-2023-49964
https://www.alfresco.com/products/community/download
https://github.com/mbadanoiu/CVE-2023-49964
https://www.alfresco.com/products/community/download

Check your stack JSON