CVE-2026-14453

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14453

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14453.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14453

Published

2026-07-13T08:19:13.094Z

Modified

2026-07-16T03:31:06.373633430Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H CVSS Calculator

Summary

A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets

Details

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14453.json",
    "cwe_ids": [
        "CWE-94"
    ],
    "cna_assigner": "Centreon"
}

References

Affected packages

Git / github.com/centreon/centreon

Affected ranges

Type

GIT

Repo

https://github.com/centreon/centreon

Events

Introduced

38e3f869ec4005acb857c92e3e2671bfa60879b4

Fixed

aeb87a0cc3543aea5aa80e7ce5fb31d52f7e68ec

Introduced

2490802617f615c4e1b9f70fb92a2a3499c50261

Fixed

09640757ab7a8f7e43734431e7aef4ce1faa8aea

Database specific

{
    "extracted_events": [
        {
            "introduced": "24.10.0"
        },
        {
            "fixed": "24.10.14"
        },
        {
            "introduced": "25.10.0"
        },
        {
            "fixed": "25.10.9"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

centreon-awie-24.*

centreon-awie-24.10.0

centreon-awie-24.10.1

centreon-dsm-24.*

centreon-dsm-24.10.0

centreon-dsm-24.10.1

centreon-dsm-24.10.2

centreon-dsm-24.10.3

centreon-ha-24.*

centreon-ha-24.10.0

centreon-ha-24.10.1

centreon-open-tickets-24.*

centreon-open-tickets-24.10.0

centreon-open-tickets-24.10.1

centreon-open-tickets-24.10.2

centreon-open-tickets-24.10.3

centreon-open-tickets-24.10.4

centreon-web-24.*

centreon-web-24.10.0

centreon-web-24.10.1

centreon-web-24.10.10

centreon-web-24.10.11

centreon-web-24.10.12

centreon-web-24.10.13

centreon-web-24.10.2

centreon-web-24.10.3

centreon-web-24.10.4

centreon-web-24.10.5

centreon-web-24.10.6

centreon-web-24.10.8

centreon-web-24.10.9

release-onprem-20250901-24.*

release-onprem-20250901-24.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14453.json"