A critical server-side template injection vulnerability in Quenary tugtainer allows authenticated users to execute arbitrary commands with root privileges inside the container.

The application utilizes an unsandboxed Jinja2 environment to render notification templates. This allows an authenticated user to perform server-side template injection (CWE-1336), enabling the execution of arbitrary operating system commands within the container context.

Successful exploitation results in full control over the containerized environment. Given the CVSS score of 9.9, this vulnerability allows an attacker to escalate privileges to root inside the container, which may facilitate container escape or access to sensitive configuration data mounted within the host.

Immediate Action: Update Quenary tugtainer to version 1.30.2 or later.

Proactive Monitoring: Monitor container logs for suspicious command execution patterns or unauthorized modifications to notification template configurations.

Compensating Controls: Implement strict network segmentation and apply the principle of least privilege to the service account running the tugtainer container.

Public Exploit Available: Unknown.

The presence of a known proof-of-concept elevates the risk of this vulnerability. Administrators must apply the patch to version 1.30.2 immediately to prevent exploitation of the template engine and secure the container environment.