CyberRota Analysis
AI-GeneratedDocker containers running Tugtainer versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI), enabling authenticated users to execute arbitrary OS commands with root privileges within the container. This critical vulnerability poses a significant risk to the integrity and security of containerized applications. Organizations utilizing Tugtainer should prioritize upgrading to version 1.30.2 to mitigate this severe threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Version 1.30.2 fixes the issue.