CVE-2026-8759 Details
Description
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
An expression language injection vulnerability has been identified in Xiandafu Beetl versions through 3.20.2. The issue resides in the SpELFunction component, specifically within the call method of SpELFunction.java. This vulnerability allows for improper neutralization of special elements in expression language statements, enabling remote exploitation. The vulnerability arises when developers explicitly register the SpELFunction in the Beetl configuration and the template content or parameters include user-controlled input. Exploitation can lead to unauthorized access to the Spring application context, allowing attackers to invoke Java static methods, instantiate objects, or access Spring beans. A proof-of-concept demonstrating the vulnerability has been publicly shared.
It is recommended to replace StandardEvaluationContext with SimpleEvaluationContext in the SpELFunction implementation. If StandardEvaluationContext must be used, provide documentation warnings about the associated security risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitee.com/xiandafu/beetl/ | [email protected] | ProductVendor |
| https://gitee.com/xiandafu/beetl/issues/IIYAWC | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/submit/811316 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364386 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364386/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xiandafu Beetl | <= 3.20.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 17, 2026 | New CVE Received | [email protected] |