Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

Posted by Ron E on Sep 03*Description:* Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that allows arbitrary operating system command execution via the #exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or...