Read the docs
TI-2024-36932 Aliases CVE-2024-55652

PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

Priority MEDIUM 64CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00672 52nd percentileScored 2026-11-07
Fix Fixed pwndoc (pwndoc): 1d4219c596f4f518798492e48386a20c6e9a2fe6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pwndocpwndocbefore 1d4219c596f4f518798492e48386a20c6e9a2fe61d4219c596f4f518798492e48386a20c6e9a2fe6Patch availableCNA
  • pwndoc Vendorpwndoc Affected before 1d4219c596f4f518798492e48386a20c6e9a2fe6 Fixed in 1d4219c596f4f518798492e48386a20c6e9a2fe6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pwndoc_project:pwndoc:*:*:*:*:*:*:*:*——pwndoc
  • cpe:2.3:a:pwndoc_project:pwndoc:*:*:*:*:*:*:*:* Versions — — ·pwndoc

Remediation

  • Fix · CNA pwndoc (pwndoc) Fixed in 1d4219c596f4f518798492e48386a20c6e9a2fe6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-55652

References

Other 3

  • TI-2022-22589 An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate… CVSS 3.1HIGH 8.8
  • TI-2025-16853 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request CVSS 3.1HIGH 8.1
  • TI-2024-36911 PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal CVSS 3.1HIGH 8.5
  • TI-2025-20248 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json CVSS 3.1MEDIUM 6.5
  • TI-2025-20245 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin CVSS 3.1MEDIUM 6.5
  • TI-2022-21648 PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names… CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences