CVE Explorer

CVE-2026-3725

A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a manipulation of the argument template_content can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used. The ven

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:855540045aed32361982258969819795842d1027c2676d04f7114be7b8c83d6b

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"modules":["FreeMarker Template Handler"],"product":"SmartAdmin","vendor":"lab1024","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"},{"status":"affected","version":"3.6"},{"status":"affected","version":"3.7"},{"status":"affected","version":"3.8"},{"status":"affected","version":"3.9"},{"status":"affected","version":"3.10"},{"status":"affected","version":"3.11"},{"status":"affected","version":"3.12"},{"stat…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/affected/1

{"modules":["FreeMarker Template Handler"],"product":"SmartAdmin","vendor":"1024-lab","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"},{"status":"affected","version":"3.6"},{"status":"affected","version":"3.7"},{"status":"affected","version":"3.8"},{"status":"affected","version":"3.9"},{"status":"affected","version":"3.10"},{"status":"affected","version":"3.11"},{"status":"affected","version":"3.12"},{"sta…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/affected/0

cvss · 4 assertions

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/1/cvssV3_1

{"metric":{"baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","version":"2.0"},"metric_type":"cvssV2_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.0"},"metric_type":"cvssV3_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/0/cvssV4_0

cwe · 2 assertions

{"cweId":"CWE-1336","description":"Improper Neutralization of Special Elements Used in a Template Engine","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-791","description":"Incomplete Filtering of Special Elements","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/affected/0

Provider-owned CVSS observations

4 source assertions

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/1/cvssV3_1

{"metric":{"baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","version":"2.0"},"metric_type":"cvssV2_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","version":"3.0"},"metric_type":"cvssV3_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions

{"cweId":"CWE-1336","description":"Improper Neutralization of Special Elements Used in a Template Engine","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-791","description":"Incomplete Filtering of Special Elements","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/problemTypes/1/descriptions/0

Source references

4 source assertions

{"name":"VDB-349703 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/?ctiid.349703"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/references/1

{"name":"VDB-349703 | 1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/?id.349703"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/references/0

{"name":"Submit #766459 | 1024-lab SmartAdmin ≤3.29 Server-Side Template Injection","tags":["third-party-advisory"],"url":"https://vuldb.com/?submit.766459"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/references/2

{"tags":["exploit"],"url":"https://www.notion.so/SmartAdmin-Server-Side-Template-Injection-SSTI-in-Email-Template-Rendering-310ea92a3c418087ac63ec8e5a061b62"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:577ca0d21dd7c5712b4460f8687d02703730605c90a6da786e829f1761d10065 · sha256:9f0f2e19d85b9db3… · /containers/cna/references/3

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer