This vulnerability (CWE-917) exists in the Glassfish gadget handler's server-side template rendering, where .xml files are processed and user-supplied values are evaluated as EL expressions without proper sanitization or escaping. An attacker can inject EL expressions (e.g., #{7*7}) that are evaluated by the server, confirming the execution context. This leads to remote code execution, allowing full compromise of the host system. Affected versions include Eclipse Glassfish 7.0.0 through 7.0.25, 7.1.0, and 8.0.0 through 8.0.1. Fixes are available in 7.0.26, 7.1.1, and 8.0.2. The vulnerability has a CVSS 3.1 score of 9.6, indicating critical severity.

Exploitation allows remote attackers to execute arbitrary code on the affected server without privileges, resulting in complete system compromise. This includes reading and modifying data, executing commands, establishing persistence, and lateral movement within the network. The vulnerability affects confidentiality, integrity, and availability of the system.

Fixes are available in Eclipse Glassfish versions 7.0.26, 7.1.1, and 8.0.2. Users should upgrade to these fixed versions to remediate the vulnerability. Patch status for versions 5.1.0 to 6.2.5 is unknown; users should consult the vendor advisory for guidance. No official remediation level is provided in the data, so applying the official fixes is the recommended mitigation.