Quest Foglight for Databases contains a server‑side template injection flaw in the renderTemplateString method that fails to validate user‑supplied strings. The vulnerability allows an authenticated attacker to inject malicious template payloads that are evaluated by the template engine, resulting in arbitrary code execution with SYSTEM privileges. This permits an attacker to compromise the host system, exfiltrate data, or pivot to other assets.

All installations of Quest Foglight for Databases are potentially affected; no specific product versions are listed in the available data. Organizations should verify whether their deployed Foglight instances are vulnerable based on the affected component described.

The CVSS score of 7.2 indicates a high severity, and the vulnerability requires authentication, so attackers must first acquire legitimate user credentials or sessions. Because the EPSS score is not available and the issue is not included in the CISA KEV catalog, the pre‑exploit probability is uncertain, but the impact of successful exploitation is severe. If credentials are compromised or the system can be tricked into using a malicious template, the attacker can achieve full system compromise at the highest privilege level.