CVE-2020-7799

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.

• CWE-917

• http://packetstormsecurity.com/files/156102/FusionAuth-1.10-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• https://fusionauth.io/docs/v1/tech/release-notesExploit, Release Notes, Vendor Advisory
• https://lab.mediaservice.net/advisory/2020-03-fusionauth.txtThird Party Advisory
• https://seclists.org/bugtraq/2020/Jan/39Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/156102/FusionAuth-1.10-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
• https://fusionauth.io/docs/v1/tech/release-notesExploit, Release Notes, Vendor Advisory
• https://lab.mediaservice.net/advisory/2020-03-fusionauth.txtThird Party Advisory
• https://seclists.org/bugtraq/2020/Jan/39Mailing List, Third Party Advisory

Published

Jan 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7791This affects the package i18n before 2.1.15. Vulnerability a…7.5
• CVE-2020-7792This affects all versions of package mout. The deepFillIn fu…7.5
• CVE-2020-7793The package ua-parser-js before 0.7.23 are vulnerable to Reg…7.5
• CVE-2020-7794This affects all versions of package buns. The injection poi…9.8
• CVE-2020-7795The package get-npm-package-version before 1.0.7 are vulnera…9.8
• CVE-2020-7796Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allow…9.8
• CVE-2020-7800The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, wi…8.2
• CVE-2020-7801The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, wi…5.3
• CVE-2020-7802The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, wi…5.3
• CVE-2020-7803IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1…8.8
• CVE-2020-7804ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for W…7.2
• CVE-2020-7805An issue was discovered on KT Slim egg IML500 (R7283, R8112,…9.8