JumpServer, an open source bastion host, has a Server‑Side Template Injection vulnerability in its Applet and VirtualApp upload process. The flaw arises from unsandboxed Jinja2 template rendering of user‑supplied YAML manifests. Attackers with administrative privileges can inject Jinja2 expressions that are evaluated inside the core container, yielding arbitrary code execution on the host. This directly jeopardizes confidentiality, integrity, and availability of the JumpServer environment and any systems managed through it.

The affected product is JumpServer (identified by the CPE cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*). No specific affected version ranges are listed in the CVE data; therefore, all releases containing the vulnerable Applet/VirtualApp upload logic may be impacted.

The CVSS score of 6.8 indicates a medium‑to‑high risk. The EPSS score of less than 1% suggests that exploitation is uncommon, and the vulnerability is not listed in the CISA KEV catalogue. However, because exploitation requires administrative access to upload privileged package manifests, the threat is limited to trusted accounts; if such access is compromised, an attacker can trivially execute arbitrary code within the core container, making the vulnerability a serious threat to privileged users.