CVE-2020-7799

CVE-2020-7799 describes a critical remote code execution vulnerability in FusionAuth versions prior to 1.11.0. Authenticated users with permissions to edit email templates or themes can leverage the Apache FreeMarker engine to execute arbitrary commands on the underlying operating system. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating a high impact on confidentiality, integrity, and availability, and a high EPSS score suggesting a significant likelihood of exploitation. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high severity and ease of exploitation by an authenticated attacker warrant immediate patching.