A flaw in the update function of the WebFileTemplateController within Dromara UJCMS allows improper neutralization of special template elements, exposing the system to server‑side template injection. This weakness can enable an attacker to inject arbitrary template code that is then processed by the underlying templating engine, potentially leading to remote code execution. The vulnerability is categorized under CWE‑1336 and CWE‑791, indicating failures in template handling and input sanitization.

All installations of Dromara UJCMS up to version 10.1.3 are affected. The flaw resides in the component web‑file‑template Endpoint and specifically targets the update operation. Any instance that has not yet been upgraded beyond 10.1.3 is susceptible, regardless of other security controls in place.

The CVSS score of 5.1 places this issue in the medium severity range, while the absence of an EPSS score means the exploitation probability is not quantified, yet the presence of a published exploit indicates a real threat. The vulnerability is remotely exploitable, allowing attackers to target the update endpoint from outside the network. Because the flaw enables direct template injection, an attacker could achieve full code execution if the templating engine runs with application privileges. The lack of a KEV listing does not diminish the immediate need for remediation, as the vulnerability has already been exploited and remains publicly known.