JWIG might allow context-dependent attackers to cause a denial of service (service…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-3816
- 2026-10-03 Alias added: GHSA-hmgx-9vqc-88wc
References
Other 6
- 20070723 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory
- http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos
- 20070722 Re: [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory
- 20070726 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory
Sources
- CVE-2007-3816 · CVE Program
- CVE-2007-3816 · NVD
- FIRST EPSS
- GHSA-hmgx-9vqc-88wc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences