The vulnerability CVE-2026-8759 affects the SpELFunction component in xiandafu beetl up to version 3.20.2. It arises from improper neutralization of special elements used in expression language statements, specifically in an unknown function within the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java. This weakness allows remote exploitation without authentication or user interaction, with low complexity and low impact on confidentiality, integrity, and availability. The project was informed early but has not provided a remediation or patch as of the published date.

The vulnerability allows remote attackers to manipulate expression language statements due to improper neutralization of special elements. This can lead to potential unauthorized actions or code execution depending on the context of expression evaluation. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. There are no confirmed exploits in the wild yet, but a public exploit exists.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider applying workarounds such as restricting access to vulnerable components or disabling the affected functionality if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.