CVE-2020-7799: Fusionauth

High severity, CVSS 7.2. EPSS: 19.8% chance of exploitation in the next 30 days.

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.

Affected products

• Fusionauth Fusionauth: before 1.11.0 (fixed in 1.11.0)

Published 2020-01-28. Last modified 2026-06-17.