DataGerry DocAPI template flaw allows remote command execution

Users with permission in DataGerry's document template feature can take over the server.

Summary

Logged-in users with template-add permission can run operating system commands on the DataGerry server through DocAPI templates. Versions before 3.3.0 are affected.

Affected when

Authenticated user with base.docapi.template.add permission
DataGerry before 3.3.0

What to do

Update to DataGerry 3.3.0.

Products and platforms

DataGerry

CVE IDs

CVE-2026-57853 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · docs.datagerry.com (opens in a new tab)
Write-up: vulncheck.com (opens in a new tab)

Times

First published 2026-11-04 17:55 UTC

First seen 2026-11-09 16:00 UTC