The vulnerability CVE-2026-8759 affects the SpELFunction component in xiandafu beetl up to version 3.20.2. It arises from improper neutralization of special elements used in an expression language statement, specifically in an unknown function within the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java. This weakness allows remote attackers to potentially execute crafted expressions leading to unintended behavior. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor has not issued any patch or official remediation, and the exploit code is publicly available.

The vulnerability allows remote attackers to exploit improper neutralization of special elements in expression language statements, potentially leading to unauthorized expression execution or manipulation. This can result in compromised application behavior or data integrity issues. The CVSS score of 6.9 reflects a moderate impact with low attack complexity and no required privileges or user interaction. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider applying application-level controls to restrict or sanitize expression language inputs if feasible. Avoid exposing vulnerable versions to untrusted networks until a patch is available.