CVE-2024-37301: document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

June 11, 2024 (updated February 4, 2026)

What kind of vulnerability is it? Who is impacted?

A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server’s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.

References

github.com/adfinis/document-merge-service
github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6
github.com/advisories/GHSA-v5gf-r78h-55q6
nvd.nist.gov/vuln/detail/CVE-2024-37301

Code Behaviors & Features

Detect and mitigate CVE-2024-37301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →