The flaw resides in Qute's ReflectionValueResolver, which fails to block access to internal Java functions when handling data types such as Enums. This oversight permits an attacker who can supply or influence template text to inject malicious content that bypasses the template engine’s defenses, ultimately allowing the execution of arbitrary server‑side commands.

The vulnerability affects Red Hat’s JBoss Enterprise Application Platform Expansion Pack, the Red Hat build of Apache Camel 4 for Quarkus 3, and the Red Hat build of Quarkus. Versions impacted are not explicitly listed in the advisory, so any deployment that incorporates the affected Qute engine—particularly the Red Hat builds referenced—remains potentially vulnerable.

With a CVSS score of 8.8 the flaw carries a high severity rating, and the EPSS score is unavailable, yet the lack of KEV listing does not diminish the risk; attackers who can manipulate template input can exploit the vulnerability without special preparation. The attack would involve supplying crafted template code that triggers the unchecked reflection look‑up, resulting in remote code execution on the host.