CVE-2026-8759

Root

Cause CVE-2026-8759 is an improper neutralization of special elements in an expression language statement within the SpELFunction component of xiandafu beetl, versions up to 3.20.2 [1]. The vulnerability resides in the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java [1]. The function fails to sanitize user-supplied input before evaluating it as a Spring Expression Language (SpEL) expression, allowing arbitrary code execution [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by crafting a malicious input that is passed to the SpELFunction [1]. The exploit is publicly available, increasing the immediate risk [1]. No special privileges or network position beyond reachability of the affected endpoint are required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the application [1]. This can lead to full compromise of the application and underlying system, including data theft, service disruption, or further lateral movement [1].

Mitigation

As of the publication date, the vendor has been informed via an issue report but has not responded or released a patch [1][2]. Users are advised to disable the SpELFunction if possible, apply input validation, or monitor for updates to beetl [1][2].