Wizarr: Server-side template injection in wizard steps leads to remote code execution
Summary
Wizarr, a user invitation and management system for media servers such as Jellyfin, Plex and Emby, evaluated wizard step Markdown in a non-sandboxed Jinja2 environment. An authenticated user who can create steps, or an administrator importing a crafted bundle, can execute arbitrary Python code when the step is rendered. Successful exploitation can run operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected media-server credentials and the database, and cause stored cross-site scripting.
Affected
- Wizarr versions before 2026.9.1
Fixed in
- Fixed in Wizarr 2026.9.1
Workaround
- Unknown. No vendor workaround was found; upgrading is the documented remedy.
Exploitation
- No evidence of exploitation in the wild found at the time of research; CISA KEV listing not confirmed.
- No public proof-of-concept found at the time of research.
- CISA SSVC: exploitation status poc, automatable no, technical impact total.
Our recommendation
- Check whether any Wizarr instance runs a version below 2026.9.1 and upgrade to 2026.9.1 or later.
- Restrict access to the Wizarr admin interface and review who holds admin or step-creation rights.
- If an instance was exposed on an older version, review wizard steps and imported bundles, rotate the SECRET_KEY and the credentials of connected media servers, and check the database for tampering.
- Monitor logs for unusual wizard imports and step edits.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wizarr release v2026.9.1 github.com
- Wizarr fix commit 6aa3c33 (restrict wizard template rendering) github.com
- GitHub Security Advisory GHSA-h9rv-mxh2-35f3 github.com
- OSV entry CVE-2026-108264 osv.dev
- Strix CVE summary CVE-2026-108264 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:05.
Original description (NVD)
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.