TI-2026-38931 Aliases CVE-2026-53964 GHSA-w47q-945m-q9pc

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

LOW 34CWE-1336Published 2026-10-01 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00493 42nd percentileScored 2026-11-07

Fix Fixed document-merge-service (adfinis): 9.1.0document-merge-service (PyPI): 9.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
adfinis	document-merge-service	before 9.1.0	9.1.0	Patch available	CNA
—	document-merge-service (PyPI)	before 9.1.0	9.1.0	Patch available	GHSA-w47q-945m-q9pc

document-merge-service Vendoradfinis Affected before 9.1.0 Fixed in 9.1.0 Patch available CNA
document-merge-service (PyPI) Vendor— Affected before 9.1.0 Fixed in 9.1.0 Patch available GHSA-w47q-945m-q9pc

Remediation

Fix · CNA document-merge-service (adfinis) Fixed in 9.1.0
Fix · GHSA-w47q-945m-q9pc document-merge-service (PyPI) Fixed in 9.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-53964
2026-10-03 Alias added: GHSA-w47q-945m-q9pc

References

Other 3

TI-2024-24813 document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences