CVE-2026-69100

Summary

The flaw allows remote code execution by executing unsandboxed Groovy scripts from database template fields, leading to arbitrary code execution and potential server compromise.

Exploitability

Exploitation is relatively straightforward as attackers can write or influence script fields via message template endpoints, requiring only access to these endpoints.

Blast radius

If exploited, the vulnerability could lead to full server compromise, allowing attackers to execute arbitrary commands and gain control over the backend server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the fixed version 5.6.2 or later, as specified in commit 84b0c27.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.